Data security management method and device, electronic equipment and computer readable medium

Abstract

The application relates to a data security management method and device, electronic equipment and a computer readable medium. The method comprises the following steps: constructing a data identity record library, the data identity record library accesses a cloud server in a local area; configuring identity tags for an access device in the local area, transmission data of the access device and storage data of the access device respectively through the data identity record library, obtaining a plurality of identity tags of the access device; and storing the plurality of identity tags of the access device and the storage data in the data identity record library. The application constructs a data identity record library for data management, and configures identity tags for device access, data transmission and data storage, which is more conducive to providing all-round information security protection and solving the personal information security problem of users in the local area.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to data security management methods, apparatus, electronic devices and computer-readable media. Background Technology

[0002] Currently, for various devices in a building environment to be controlled in the cloud, a centralized cloud server is needed to serve as the hub for information transmission between the devices and the host computer. Today, the continuous rise in digitalization in the building sector presents significant challenges to data security related to building control. Unlike wide area network cloud products on the market, users prefer to store data within a small, dedicated local area network (LAN) cloud server within their building system. This is primarily due to concerns about data storage security, data transmission security, and the security of connected devices, believing that data within a small LAN is protected from many unnecessary security attacks. Large buildings such as factories and office buildings are increasingly advocating for the concept of data remaining within the building.

[0003] Because miniaturized LAN cloud servers have relatively closed network boundaries, they primarily employ protection technologies such as firewalls and TLS encryption. However, these technologies all have drawbacks that make them unsuitable for building control systems. For example, firewalls restrict internal access to untrusted sources, providing protection at the access layer, but this one-size-fits-all approach makes it inconvenient for building control systems to frequently add new access devices. Furthermore, TLS encryption only protects information at the transport layer, failing to protect data at the access and storage layers. Moreover, cracking the encryption of a single link allows for the interception of all transmitted information on that link. Therefore, data security in miniaturized LAN cloud servers needs improvement during device access, data storage, transmission, and retrieval. Summary of the Invention

[0004] This application provides data security management methods, apparatus, electronic devices, and computer-readable media to solve the technical problem of low data security in cloud servers of miniaturized local area networks during device access, data transmission, storage, and retrieval processes in the prior art.

[0005] According to one aspect of the embodiments of this application, this application provides a data security management method, the method comprising: constructing a data identity record library, the data identity record library being connected to a cloud server within a local area; configuring identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record library, thereby obtaining multiple identity tags for the access devices; and storing the multiple identity tags of the access devices and the storage data in the data identity record library.

[0006] Optionally, the step of configuring identity tags for access devices within the local area, the transmitted data of the access devices, and the stored data of the access devices through the data identity record library to obtain multiple identity tags for the access devices includes: performing a first identity verification on each of the access devices within the local area using a preset encryption algorithm in the data identity record library to obtain a first identity tag for the access devices; performing a second identity verification on the transmitted data of each of the access devices during data transmission using a preset encryption algorithm in the data identity record library to obtain a second identity tag for the access devices; storing the transmitted data in the data identity record library, and performing a third identity verification on the stored data of each of the access devices using a preset encryption algorithm in the data identity record library to obtain a third identity tag for the access devices.

[0007] Optionally, the step of performing the first identity verification on each of the access devices within the local area using a preset encryption algorithm in the data identity record database includes: obtaining device access requests from each of the access devices within the local area to access the cloud server through the data identity record database; based on the device access requests, performing MD5 hash calculation on each access device according to the MD5 code generation rules set in the data identity record database, and configuring a first independent label for each access device; and performing the first identity verification on the corresponding access device based on the first independent label to obtain a first identity label for the access device.

[0008] Optionally, the step of performing a second identity verification on the transmission data of each access device during data transmission using a preset encryption algorithm in the data identity record database includes: acquiring the transmission data of each access device, wherein the transmission data of each access device is transmitted in parallel based on a single-link multi-channel method; performing MD5 hash calculation on each transmission data according to the MD5 code generation rules set in the data identity record database, and configuring a second independent label for each transmission data; and performing a second identity verification on the transmission data of the corresponding access device based on the second independent label to obtain a second identity label for the access device.

[0009] Optionally, the step of storing the transmission data in the data identity record database and performing a third identity verification on the stored data of each access device using a preset encryption algorithm in the data identity record database includes: storing the transmission data of each access device in a data storage table in the data identity record database to obtain the stored data; performing MD5 hash calculation on each of the stored data according to the MD5 code generation rules set in the data identity record database to configure a third independent label for each of the stored data; and performing a third identity verification on the corresponding stored data based on the third independent label to obtain a third identity label for the access device.

[0010] Optionally, before performing the first identity verification of the corresponding access device based on the first independent label, the method further includes: performing a label deduplication judgment on the first independent label of each access device through the data identity record database; if at least two access devices have the same first independent label, then the first independent label of the access device is reassigned; if the first independent labels of each access device are different, then the first identity verification of each access device is performed.

[0011] Optionally, the method further includes: obtaining a data read request sent by the device to be accessed to the cloud server; determining the identity tag and request data of the device to be accessed based on the data read request; verifying the identity tag of the device to be accessed through the data identity record library to detect whether the identity tag of the device to be accessed is stored in the data identity record library; if the identity tag of the device to be accessed is stored in the data identity record library, then the verification is successful, and multiple identity tags corresponding to the request data are sent, and data is read based on the multiple identity tags of the request data; if the identity tag of the device to be accessed is not stored in the data identity record library, then the verification fails, and the device to be accessed is prohibited from reading data.

[0012] According to another aspect of the embodiments of this application, this application provides a data security management device, the device comprising: a construction module for constructing a data identity record library, the data identity record library being connected to a cloud server within a local area; a tag configuration module for configuring identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record library, thereby obtaining multiple identity tags for the access devices; and a storage module for storing the multiple identity tags of the access devices and the storage data in the data identity record library.

[0013] According to another aspect of the embodiments of this application, this application provides an electronic device, including a memory, a processor, a communication interface, and a communication bus. The memory stores a computer program that can run on the processor. The memory and the processor communicate through the communication bus and the communication interface. When the processor executes the computer program, it implements the steps of the data security management method described above.

[0014] According to another aspect of the embodiments of this application, this application provides a computer-readable medium having processor-executable non-volatile program code that causes the processor to perform the steps of the data security management method.

[0015] Compared with related technologies, the technical solutions provided in this application have the following advantages:

[0016] This application provides a data security management method that, by constructing a data identity record library for cloud servers within a local area, not only enables secure management of identity tags and stored data of access devices, but also allows for device verification based on identity tags when receiving data read requests, thus improving data security management capabilities. By configuring different identity tags for access devices, their transmitted data, and the stored data in the data identity record library, a full-link data security protection is formed from the device layer to the cloud server. This ensures the security of access devices within the local area, prevents the interception of transmitted data, and ensures that stored data cannot be deciphered, providing comprehensive information security protection and avoiding attacks or data theft caused by unauthorized device access, thus providing more secure and reliable protection for users' personal information within the local area. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the hardware environment for an optional data security management method provided according to an embodiment of this application;

[0020] Figure 2 This is a schematic diagram of an optional data security management method provided according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram illustrating an optional access device accessing a digital base station according to an embodiment of this application;

[0022] Figure 4 This is an optional three-dimensional identity identification distribution map provided according to an embodiment of this application;

[0023] Figure 5 This is an optional device access flowchart provided according to an embodiment of this application;

[0024] Figure 6 This is an optional data reading flowchart provided according to an embodiment of this application;

[0025] Figure 7 This is a structural diagram of an optional data security management device according to an embodiment of this application;

[0026] Figure 8 This is a schematic diagram of an optional electronic device structure provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] To address the problems mentioned in the background art, an embodiment of a data security management method is provided according to one aspect of the embodiments of this application.

[0029] like Figure 1 As shown, the above data security management methods can be applied to, for example... Figure 1 The hardware environment shown is described. The system architecture 100 of the hardware environment includes a terminal device 101 and a server 103. The server 103 is connected to the terminal 101 via a network and can be used to provide services to the terminal or clients installed on the terminal. A database 105 can be set up on the server or independently of the server to provide data storage services to the server 103. The network can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0030] Users can use terminal device 101 to interact with server 103 via a network to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, search applications, instant messaging tools, etc. Terminal device 101 can be various electronic devices with a display screen that support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc. Server 103 can be a server providing various services, such as a backend server supporting the pages displayed on terminal device 101.

[0031] It should be noted that the data security management method provided in this application embodiment is generally executed by a server and / or terminal device, and correspondingly, the data security management device is generally installed in the server / terminal device. Furthermore, it should be understood that... Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0032] like Figure 2 As shown, Figure 2 A flowchart illustrating a data security management method provided in an embodiment of the present invention. Taking the execution of the data security management method by a server as an example, a data security management method includes the following steps:

[0033] Step S202: Construct a data identity record library, which is connected to a cloud server within the local area.

[0034] In this embodiment, the provided data security management method is applicable to scenarios where devices within a local area access a cloud server for data security management. This includes security management of devices in buildings such as factories and office buildings within the local area accessing the cloud server for data storage and retrieval. The local area of ​​the cloud server can be limited to the area where office buildings are located within a district, and the specific area can be preset according to the actual scenario; it is not a unique limitation here.

[0035] In this embodiment, combined with Figure 3As shown, the aforementioned data identity record library can be constructed within the digital base of a cloud server. The data identity record library can be connected to the cloud server via wireless or wired connections. The digital base possesses functions such as protocols for access devices to connect to the digital base, parsing channels, data storage, a data identity record library, and data retrieval. Different access devices can correspond to different protocols, and the data transmitted by different access devices is based on different parsing channels. The parsing channel is responsible for parsing the received data and transmitting it to the target location according to the protocol. During data transmission, the parsing channel acts as a bridge and link, ensuring accurate and efficient data transmission. For example, device A and device B connect to the digital base of the cloud server. Device A transmits data and communicates via parsing channel A based on protocol A, while device B transmits data and communicates via parsing channel B based on protocol B. Parsing channels A and B transmit the data to the data identity record library for storage.

[0036] Furthermore, the aforementioned protocols refer to all device protocols connected to the digital docking station, including but not limited to Modbus RTU, Modbus TCP, and other access protocols. Of course, different devices can also communicate based on the same protocol, but transmit data through different parsing channels. For example, device A and device B both use Modbus RTU communication, but device A uses parsing channel A for data transmission, while device B uses parsing channel B. Using different transmission channels ensures that data transmission does not interfere with each other.

[0037] In this embodiment, a data identity record database is established to store and manage the transmission data of each access device and its corresponding identity identification information, ensuring the security, reliability, and efficiency of the database, and enabling fast and accurate identity identification during data transmission. The construction of the data identity record database can be based on an overall architecture design according to the target functions. These target functions include, but are not limited to, data storage, identity identification, identity identification information storage, and device authentication. Identity identification includes data encryption; therefore, encryption technologies, such as MD5 and SHA-256 hash algorithms, need to be determined when constructing the data identity record database. For data storage, a corresponding database management system needs to be determined, including but not limited to MySQL and PostgreSQL. Constructing the data identity record database also requires building database tables, including device information tables, data record tables, and identity identification record tables, to store different types of information respectively.

[0038] Furthermore, the connection of the aforementioned data identity record database to the cloud server within the local area network also includes cloud server configuration: configuring the hardware and software environment of the cloud server according to requirements, and ensuring network connectivity between the cloud server and the data identity record database. A connection is established between the data identity record database and the cloud server using database connection tools or libraries, and database connection parameters such as IP address, port number, username, and password are configured.

[0039] In this embodiment, by constructing a data identity record library for cloud servers within the local area, it is possible not only to achieve secure management of identity tags and stored data of access devices, but also to perform device verification based on identity tags when receiving data read requests, which is more conducive to improving data security management capabilities.

[0040] Step S204: Configure identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record database, thereby obtaining multiple identity tags for the access devices.

[0041] In this embodiment, when multiple access devices within a local area access the cloud server, a data identity record library can be used to match different identity tags for each access device upon connection, ensuring that each access device has an independent identity. After the access device officially connects, data is transmitted through a parsing channel. During data transmission, the data identity record library again configures different identity tags for the transmitted data in each channel, ensuring that the data cannot be intercepted during transmission. When data transmission is complete and data is stored, the data identity record library again configures different identity tags for the stored data of each access device, ensuring that the stored data cannot be deciphered and improving data security. In this way, the same access device undergoes identity identification during the access, data transmission, and data storage processes, generating three identity tags.

[0042] In some examples, before configuring identity tags again, it's possible to check if the previous configuration was successful. Only after confirming the previous configuration was complete should the next configuration proceed; otherwise, a data anomaly report should be submitted. This multi-layered pre-configuration checks improve data security, ensuring only locally accessible devices are connected, thus preventing malicious data intrusions that could cause system malfunctions.

[0043] Step S206: Store the multiple identity tags of the access device and the stored data in the data identity record database.

[0044] In this embodiment, the access device's stored data and identity tags are stored in different data tables in the data identity record database. The storage table names for the access device's stored data and the identity tags are different, and multiple data tables can be configured for the same type of data to store more data. For example, the identity tag storage table includes identity tag tables A through C. Furthermore, a data mapping table may be included to store the mapping relationship between the access device and the corresponding identity tag, enabling fast identity tag lookup based on the access device.

[0045] In this embodiment of the invention, by constructing a data identity record library for cloud servers within the local area, not only can secure management of identity tags and stored data of access devices be achieved, but device verification can also be performed based on identity tags when receiving data read requests, which is more conducive to improving data security management capabilities. By assigning different identity tags to access devices, the transmission data of access devices, and the stored data of access devices stored in the data identity record library, a full-link data security protection is formed from the device layer to the cloud server, ensuring the security of access devices within the local area, the inability to intercept transmission data, and the inability to decipher stored data, thereby providing comprehensive information security protection, avoiding the problem of attacks or data theft caused by unauthorized device access, and more securely and reliably protecting users' personal information within the local area.

[0046] In an optional embodiment, step S204 specifically includes:

[0047] S2041, using the preset encryption algorithm in the data identity record database, perform the first identity verification on each of the access devices within the local area to obtain the first identity label of the access device;

[0048] S2042, using the preset encryption algorithm in the data identity record database, perform a second identity verification on the transmitted data of each access device during the data transmission process to obtain the second identity tag of the access device;

[0049] S2043, the transmitted data is stored in the data identity record library, and the stored data of each access device is subjected to a third identity verification through a preset encryption algorithm in the data identity record library to obtain the third identity tag of the access device.

[0050] Combination Figure 4As shown in this embodiment, when the data identity record database detects that at least one access device within the local area requests access to the cloud server, it can perform a first identity verification on each access device using a preset encryption algorithm to obtain a first identity tag for each access device. The first identity tag is used to encrypt each access device, and each access device has a different first identity tag. The preset encryption algorithm includes, but is not limited to, MD5, SHA-256, TLS, etc., to achieve encryption and improve data security.

[0051] In some examples, after the access devices are connected, each access device will transmit data. Each access device will be allocated an independent parsing channel. The data transmission of each access device will form a single-link multi-channel access mode, which helps to ensure that the data is independent and does not interfere with each other.

[0052] In this embodiment, when data is transmitted, the transmitted data of each channel is identified a second time by a preset encryption algorithm in the data identity record database to obtain the second identity tag of the access device. The data transmission process is encrypted through identity identification, which helps to ensure that the data information during the transmission process cannot be intercepted.

[0053] In this embodiment, after the parsing channel completes data transmission, the transmitted data is stored in a data identity record database. The stored data is actually the same as the transmitted data; the distinction is only to better describe the nodes of the three identity verifications. Similarly, a third identity verification can be performed on the stored data of each access device based on a preset encryption algorithm in the data identity record database to obtain the third identity tag of the access device, thus completing the encryption of the stored data. This multi-layered data identity verification helps ensure that the stored data cannot be deciphered.

[0054] In this embodiment, a comprehensive data identity record database with robust security is provided. Identity verification and encryption are implemented layer by layer, from the device layer to the cloud server, enhancing overall information security and effectively addressing the problem of poor information security within a local area. Furthermore, data transmission via a single-link, multi-channel data access method ensures that data from different devices is independent of each other.

[0055] In an optional embodiment, step S2041 specifically includes:

[0056] The data identity record database is used to obtain device access requests from each of the access devices within the local area to access the cloud server.

[0057] Based on the device access request, MD5 hash calculation is performed on each access device according to the MD5 code generation rules set in the data identity record database, and a first independent label is configured for each access device;

[0058] Based on the first independent tag, the corresponding access device is first identified to obtain the first identity tag of the access device.

[0059] In some embodiments, the methods used to encrypt the access device, transmitted data, and stored data can be the same or different. To improve the efficiency and consistency of encryption, this embodiment describes the three encryption algorithms using the MD5 (Message-Digest Algorithm 5) algorithm. MD5 is a widely used hash function that produces a 128-bit (16-byte) hash value (typically represented as a 32-bit hexadecimal number).

[0060] In this embodiment, if each access device within the local area wants to join the cloud server, it needs to send a device access request to the cloud server. After receiving the device access requests from each access device, the data identity record database can extract the name of each device to distinguish different access devices. Then, a first independent tag is configured for each access device, and the first independent tag is identified for the first time by using MD5 code.

[0061] In some examples, MD5 generation rules are pre-defined when creating the data identity record library. This ensures that a unique and unpredictable MD5 code is generated for each access device, each transmitted data, and each stored data. These MD5 generation rules can be formulated in conjunction with factors such as data integrity, security, and verifiability. Furthermore, MD5 codes can be used by the data identity record library to efficiently manage access devices. For example, the library maintains a list of MD5 hashes of registered devices. When a new device attempts to access the system, it simply calculates the MD5 hash of its identifier and compares it to the values ​​in the list.

[0062] In this embodiment, within the local area, after receiving a device access request from an access device, MD5 hash calculation is performed based on the preset MD5 code generation rules in the data identity record library. A first independent label is configured for each access device. The first identity identification is performed based on the assigned first independent label, which can be used to verify the legitimacy of the device or user identity. Moreover, a unique first independent label is generated for each access device, which helps the data identity record library to quickly identify and manage devices and improve device management security.

[0063] In an optional embodiment, combined with Figure 5 As shown, before performing the first identity verification of the corresponding access device based on the first independent tag, the method further includes:

[0064] The first independent tag of each access device is checked for duplicates using the data identity record database.

[0065] If at least two of the access devices have the same first independent label, then the first independent label of the access devices shall be reassigned;

[0066] If the first independent tags of each access device are different, then the first identity verification of each access device is performed.

[0067] In this embodiment, to ensure that each access device is assigned a unique tag, a tag deduplication operation can be performed before the device accesses the network. Specifically, in conjunction with... Figure 5 As shown, when devices A and B request access to the digital base of the cloud server, the data identity record library in the digital base can configure a first independent label for each device. Then, the data identity record library performs a label duplication check on the first independent labels of devices A and B, determining if a label with the same first independent label already exists in the data identity record library. If so, it will reassign the first independent label to either device A or device B. Alternatively, if the data identity record library detects that devices A and B have the same assigned first independent label, it will reassign the first independent label to both devices until no duplicate first independent labels are found. Finally, the first identity verification for each accessing device is performed. This ensures that data from different accessing devices is independent and does not interfere with each other, and that the labels are unique, facilitating efficient and accurate device management by the data identity record library.

[0068] In this implementation, by performing duplicate checks on the first independent label, the uniqueness of the assigned first independent label can be guaranteed. This ensures that the data accessed by different devices are independent and do not interfere with each other, and that the labels are unique, which facilitates efficient and accurate device management by the data identity record database.

[0069] In an optional embodiment, step S2042 specifically includes:

[0070] The transmission data of each access device is acquired, and the transmission data of each access device is transmitted in parallel based on a single-link multi-channel method.

[0071] According to the MD5 code generation rules set in the data identity record database, perform MD5 hash calculation on each of the transmitted data, and configure a second independent tag for each of the transmitted data;

[0072] Based on the second independent tag, the transmission data of the corresponding access device is subjected to a second identity identification to obtain the second identity tag of the access device.

[0073] In this embodiment, the transmission data of each access device is transmitted in parallel using a single-link multi-channel method, ensuring that the data from different access devices is independent. When an access device is about to enter the data transmission process, the device access request can be parsed to extract the transmission data of the access device. The data identity record library can perform MD5 hash calculation on the transmission data of each access device based on the set MD5 code generation rules, configure a second independent tag for each transmission data, and then the data identity record library performs a second identity identification on each transmission data according to the second independent tag of each transmission data.

[0074] In some embodiments, the method of performing independent tag deduplication on the access device in the above embodiments can also be applied to the deduplication of the second independent tag of the transmitted data, so as to ensure the uniqueness of the second independent tag assigned to each transmitted data, and facilitate the storage and management of the data identity record library.

[0075] In this embodiment, after the initial identification, the data transmitted by each access device is hashed based on the set MD5 code generation rules to configure a second independent tag, thereby achieving encryption during data transmission, enhancing data transmission security, and reducing the possibility of data interception by the access device during data transmission.

[0076] In an optional embodiment, step S2043 specifically includes:

[0077] The transmission data of each of the access devices is stored in the data storage table in the data identity record database to obtain the stored data;

[0078] According to the MD5 code generation rules set in the data identity record database, MD5 hash calculation is performed on each of the stored data, and a third independent tag is configured for each of the stored data.

[0079] Based on the third independent tag, the corresponding stored data is subjected to a third identity verification to obtain the third identity tag of the access device.

[0080] In this embodiment, after the parsing channel transmits each data to the data identity record library in the digital base station, it will be stored in the corresponding data table of the data identity record library. At this time, the transmitted data is converted into stored data in the data identity record library. Data storage can be performed according to the order of the timestamps of the data received by the data identity record library. The data identity record library may include at least one data storage table, a device ID table, an identity tag storage table, an access device information storage table, etc., with different data tables used to store different types of data. Among them, the data storage table is used for the transmission data of each access device within the local area; the device ID table is used to store the device information of each access device within the local area for differentiation; the identity tag storage table is used to store the first identity tag, the second identity tag, and the third identity tag; and the access device information storage table is used to store the device information and reading information of the access device that sends a data reading request to the cloud server.

[0081] Furthermore, after the second identity verification, the MD5 hash calculation can be performed on the stored data of each access device based on the MD5 code generation rules set in the data identity record library, and a third independent label can be configured for each stored data. The data identity record library will then perform a third identity verification on the corresponding stored data based on each third independent label.

[0082] In some examples, the method of deduplication for independent tags of access devices can also be applied to deduplication of third independent tags of stored data, so as to ensure the uniqueness of the assigned third independent tags and facilitate the efficient management and storage of the data identity record library.

[0083] In this embodiment, by using layer-by-layer data identity verification, it is beneficial to ensure that the stored data in the data identity record database cannot be deciphered, thereby improving data security and avoiding the possibility of malicious theft of the stored data in the data identity record database.

[0084] In an optional embodiment, step S206 specifically includes:

[0085] S2061, Obtain the data read request sent by the device to be connected to the cloud server, and determine the identity tag and request data of the device to be connected based on the data read request;

[0086] S2062, The identity tag of the device to be accessed is verified through the data identity record library to detect whether the identity tag of the device to be accessed is stored in the data identity record library;

[0087] S2063, if the identity tag of the device to be accessed has been stored in the data identity record database, then the verification is passed, and multiple identity tags corresponding to the request data are sent, and data is read based on the multiple identity tags of the request data;

[0088] S2064, if the identity tag of the device to be accessed is not stored in the data identity record database, the verification fails and the device to be accessed is prohibited from reading data.

[0089] In this embodiment, the device to be accessed may be a device within the local area network or an access device outside the local area network. Access devices outside the local area network will not be allowed to read data. For data within the local area network, user access permissions and access levels can be determined based on user verification results to implement hierarchical management, thereby determining the depth at which users can read data and preventing users from arbitrarily reading data and causing data theft. For example, general staff and network administrators in an office building have different network access permissions and access levels, with network administrators having a deeper data reading depth.

[0090] Combination Figure 6 As shown in this embodiment, the data identity record database stores information such as the identity tags of all access devices within the local area. When other devices want to access information that has undergone three-way identity verification, they need to perform identity verification to determine whether the device to be accessed has permission. Specifically, the data read request can be decoded to obtain the identity tag of the device to be accessed and the request data. The identity tag can be the unique identifier, ID information, username, and login password of the device to be accessed. Furthermore, the identity tag of the device to be accessed can be compared with the identity tags of each access device stored in the data identity record database to determine whether the identity tag of the device to be accessed is already stored in the data identity record database.

[0091] Furthermore, once the device is confirmed to be a legitimate, securely authorized device, the data identity record library sends multiple identity tags to the requested data. Based on these tags, the device successfully accesses the data identity record library's storage layer to read the data, with the data depth corresponding to the user's level. If the verification fails, the device is not authorized to read the data. In some embodiments, devices prohibited from reading data can be marked, facilitating rapid identification upon subsequent repeated accesses.

[0092] In some examples, if the identity tag of the device to be accessed is stored in the data identity record database, it indicates that the device to be accessed is a local access device and has been stored, therefore the device to be accessed passes the verification. The data identity record database returns the first identity tag, second identity tag, and third identity tag of the request data of the device to be accessed to the device. The device to be accessed successfully accesses the storage layer of the data identity record database based on these three identity tags, determines the corresponding data table based on the type of the requested data, and then reads the data.

[0093] In other examples, if the identity tag of the device to be accessed is not stored in the data identity record database, it indicates that the device may pose a risk, be an access device outside the local area, or be a newly added access device within the local area. In the case where the device to be accessed is a newly added device within the local area, device registration can be performed first to store the device information in the data identity record database before data retrieval. If the identity tag of the device to be accessed is detected as not being stored in the data identity record database, the verification will fail, and the first, second, and third identity tags requested for the data will not be sent back to the device to be accessed; therefore, data retrieval cannot be performed.

[0094] In this embodiment, the device to be connected to the cloud server can only read the corresponding data in the data identity record database after the data identity record database has been verified. This ensures the accuracy of the data and guarantees that the stored data cannot be read arbitrarily, thereby improving the security of data storage within the local area and protecting the user's personal information more securely.

[0095] According to another aspect of the embodiments of this application, such as Figure 7 As shown, corresponding to the data security management method in the above embodiments, this embodiment provides a data security management device, the device comprising:

[0096] Module 701 is used to build a data identity record library, which is connected to a cloud server within a local area.

[0097] The tag configuration module 703 is used to configure identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record library, so as to obtain multiple identity tags for the access devices;

[0098] The storage module 705 is used to store the multiple identity tags of the access device and the stored data in the data identity record library.

[0099] Optionally, the tag configuration module 703 includes: a first calibration submodule, used to perform a first identity calibration on each of the access devices within the local area using a preset encryption algorithm in the data identity record library, to obtain a first identity tag for the access device; a second calibration submodule, used to perform a second identity calibration on the transmitted data of each of the access devices during data transmission using a preset encryption algorithm in the data identity record library, to obtain a second identity tag for the access device; and a third calibration submodule, used to store the transmitted data in the data identity record library and perform a third identity calibration on the stored data of each of the access devices using a preset encryption algorithm in the data identity record library, to obtain a third identity tag for the access device.

[0100] Optionally, the first calibration submodule includes: a first acquisition subunit, configured to acquire device access requests from each of the access devices within a local area to access the cloud server through the data identity record database; a first calculation subunit, configured to perform MD5 hash calculation on each access device based on the device access request and according to the MD5 code generation rules set in the data identity record database, and configure a first independent label for each access device; and a first calibration subunit, configured to perform a first identity calibration on the corresponding access device based on the first independent label, and obtain a first identity label for the access device.

[0101] Optionally, the second calibration unit includes: a second acquisition subunit, configured to acquire the transmission data of each access device, wherein the transmission data of each access device is transmitted in parallel based on a single-link multi-channel method; a second calculation subunit, configured to perform MD5 hash calculation on each transmission data according to the MD5 code generation rules set in the data identity record database, and configure a second independent label for each transmission data; and a second calibration subunit, configured to perform a second identity calibration on the transmission data of the corresponding access device based on the second independent label, to obtain a second identity label for the access device.

[0102] Optionally, the third calibration submodule includes: a data storage subunit, used to store the transmission data of each access device into a data storage table in the data identity record database to obtain the stored data; a third calculation subunit, used to perform MD5 hash calculation on each of the stored data according to the MD5 code generation rules set in the data identity record database to configure a third independent label for each of the stored data; and a third calibration subunit, used to perform a third identity calibration on the corresponding stored data based on the third independent label to obtain a third identity label for the access device.

[0103] Optionally, the device further includes a deduplication module, used to perform tag deduplication judgment on the first independent tags of each access device through the data identity record database; if at least two access devices have the same first independent tag, the first independent tag of the access device is reassigned; if the first independent tags of each access device are different, the first identity labeling of each access device is performed.

[0104] Optionally, the device further includes: a data reading module, configured to acquire a data reading request sent by the device to be accessed to the cloud server, determine the identity tag and request data of the device to be accessed based on the data reading request; verify the identity tag of the device to be accessed through the data identity record library, and detect whether the identity tag of the device to be accessed is stored in the data identity record library; if the identity tag of the device to be accessed is stored in the data identity record library, the verification is successful, and multiple identity tags corresponding to the request data are sent, and data reading is performed based on the multiple identity tags of the request data; if the identity tag of the device to be accessed is not stored in the data identity record library, the verification fails, and the device to be accessed is prohibited from reading data.

[0105] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented either through software or through hardware.

[0106] It should be noted that the suffixes such as module, component, unit, submodule, and subunit used to represent elements in the above-described device are only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, they can be used in combination.

[0107] According to another aspect of the embodiments of this application, this application provides an electronic device, such as... Figure 8 As shown, it includes a memory 801, a processor 803, a communication interface 805, and a communication bus 807. The memory 801 stores a computer program that can run on the processor 803. The memory 801 and the processor 803 communicate through the communication interface 805 and the communication bus 807. When the processor 803 executes the computer program, it implements the steps of the above-mentioned data security management method.

[0108] The memory and processor in the aforementioned electronic devices communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0109] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0110] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0111] According to another aspect of the embodiments of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the data security management method in any of the above embodiments.

[0112] Optionally, in embodiments of this application, the computer-readable medium is configured to store program code for the processor to perform steps of the data security management method described below, the data security management method including the following steps:

[0113] Step S202: Construct a data identity record library, which is connected to a cloud server within a local area.

[0114] Step S204: Configure identity tags for access devices within the local area, the transmitted data of the access devices, and the stored data of the access devices through the data identity record database to obtain multiple identity tags for the access devices;

[0115] Step S206: Store the multiple identity tags of the access device and the stored data in the data identity record database.

[0116] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here. Furthermore, in the specific implementation of this application embodiment, the above embodiments can be consulted, and corresponding technical effects can be achieved.

[0117] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0118] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0119] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0121] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0122] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, the functional units in the various embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0123] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0124] It should be noted that, in this document, relational terms such as "first," "second," etc., are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprises a…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0125] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A data security management method applied to cloud servers in miniaturized local area networks, characterized in that, The method includes: A data identity record library is constructed, which is connected to a cloud server within a local area. The data identity record library is used for data storage, identity identification, identity identification information storage, and device authentication. The data identity record database is used to configure identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices, respectively, to obtain multiple identity tags for the access devices. The identity tags of the access devices are used to give each access device an independent identity, the identity tags of the transmission data are used to make the transmission data uninterrupted during transmission, and the identity tags of the storage data are used to make the storage data undecipherable. The multiple identity tags of the access device and the stored data are stored in the data identity record database; The step of configuring identity tags for access devices within a local area, their transmitted data, and their stored data using the data identity record library to obtain multiple identity tags for the access devices includes: performing a first identity verification on each access device within the local area using a preset encryption algorithm in the data identity record library to obtain a first identity tag for the access device; performing a second identity verification on the transmitted data of each access device during data transmission using the preset encryption algorithm in the data identity record library to obtain a second identity tag for the access device; storing the transmitted data in the data identity record library, and performing a third identity verification on the stored data of each access device using the preset encryption algorithm in the data identity record library to obtain a third identity tag for the access device.

2. The data security management method according to claim 1, characterized in that, The first identification of each access device within the local area using a preset encryption algorithm in the data identity record database includes: The data identity record database is used to obtain device access requests from each of the access devices within the local area to access the cloud server. Based on the device access request, MD5 hash calculation is performed on each access device according to the MD5 code generation rules set in the data identity record database, and a first independent label is configured for each access device; Based on the first independent tag, the corresponding access device is first identified to obtain the first identity tag of the access device.

3. The data security management method according to claim 1, characterized in that, The second identity verification of the transmitted data of each access device during data transmission is performed using a preset encryption algorithm in the data identity record database, including: The transmission data of each access device is acquired, and the transmission data of each access device is transmitted in parallel based on a single-link multi-channel method. According to the MD5 code generation rules set in the data identity record database, perform MD5 hash calculation on each of the transmitted data, and configure a second independent tag for each of the transmitted data; Based on the second independent tag, the transmission data of the corresponding access device is subjected to a second identity identification to obtain the second identity tag of the access device.

4. The data security management method according to claim 1, characterized in that, The step of storing the transmitted data in the data identity record database and performing a third identity verification on the stored data of each access device using a preset encryption algorithm in the data identity record database includes: The transmission data of each of the access devices is stored in the data storage table in the data identity record database to obtain the stored data; According to the MD5 code generation rules set in the data identity record database, MD5 hash calculation is performed on each of the stored data, and a third independent tag is configured for each of the stored data. Based on the third independent tag, the corresponding stored data is subjected to a third identity verification to obtain the third identity tag of the access device.

5. The data security management method according to claim 2, characterized in that, Before performing the first identity verification on the corresponding access device based on the first independent tag, the method further includes: The first independent tag of each access device is checked for duplicates using the data identity record database. If at least two of the access devices have the same first independent label, then the first independent label of the access devices shall be reassigned; If the first independent tags of each access device are different, then the first identity verification of each access device is performed.

6. The data security management method according to any one of claims 1 to 5, characterized in that, The method further includes: Obtain the data read request sent by the device to be connected to the cloud server, and determine the identity tag and request data of the device to be connected based on the data read request; The identity tag of the device to be accessed is verified through the data identity record database to detect whether the identity tag of the device to be accessed is stored in the data identity record database; If the identity tag of the device to be accessed is already stored in the data identity record database, then the verification is performed, and multiple identity tags corresponding to the request data are sent, and data is read based on the multiple identity tags of the request data; If the identity tag of the device to be accessed is not stored in the data identity record database, the verification fails, and the device to be accessed is prohibited from reading data.

7. A data security management device for implementing the data security management method as described in any one of claims 1 to 6, characterized in that, The device includes: The building module is used to build a data identity record library, which is connected to a cloud server within a local area. The tag configuration module is used to configure identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record library, so as to obtain multiple identity tags for the access devices. A storage module is used to store multiple identity tags of the access device and the stored data in the data identity record library.

8. An electronic device comprising a memory, a processor, a communication interface, and a communication bus, wherein the memory stores a computer program executable on the processor, and the memory and the processor communicate via the communication bus and the communication interface, characterized in that... When the processor executes the computer program, it implements the data security management method according to any one of claims 1 to 6.

9. A computer-readable medium having processor-executable non-volatile program code, characterized in that, The program code causes the processor to execute the data security management method according to any one of claims 1 to 6.

Images