Security level identifier management method and system

Abstract

The invention discloses a security level identifier management method and system, and relates to the technical field of communication, and the method comprises the steps of security level identifier generation and addition, security level identifier detection and security level identifier updating. The generation and addition of the security level identifier provided by the invention comprise the processes of secret-related file creation, secret-related file examination and approval, integrity inspection, file examination and approval, generation of security level identifier information, formation of secret-related files, digital signature and the like. The security level identification detection comprises the processes of user identity authentication, confidential file access request, user and identification information obtaining, whether the user can open the file or not, whether ciphertext is generated or not, security level identification attribute information updating, printing request, security level identification attribute information updating and the like. The provided security level identifier updating comprises the processes of identifier security attribute change request, approval, flow and log attribute information acquisition by a terminal agent and the like, so that the confidential file can be effectively protected by the security level identifier in the whole life cycle.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and system for managing confidentiality level identification. Background Art

[0002] In recent years, with the rapid development of the Internet and multimedia technology, office automation and e-government systems have been widely used in state organs and enterprises and institutions. However, due to the easy duplication of electronic files, their security has been greatly challenged. The "Technical Requirements for the Grading Protection of Computer Information Systems Involving State Secrets" emphasizes that information in confidential information systems should have corresponding confidentiality identification, which should be inseparable from the information subject and cannot be tampered with. The confidentiality identification is a kind of data that indicates the confidentiality level of a confidential file. The confidentiality identification and the corresponding confidential file are bound together through specific technology to form a confidential file.

[0003] The confidentiality level identification is a digital entity bound to a confidential file. It is closely associated with the confidential file entity and protectively encrypts the confidential file. It also records the file's attributes and status information, defines access permission policies such as the file's operation objects and operation behaviors, and records the user's identity and operation behavior in each file processing link, ensuring that the file is always in a safe and controllable state in all processes such as creation, editing, storage, change, forwarding and review. It can also trace and audit every use detail of the file, thereby achieving safe and controllable confidentiality throughout the entire life cycle of the file.

[0004] In the patent publication number CN109388952A, "A method and device for binding confidential documents and confidentiality identification", it is proposed to divide the confidentiality identification into two parts, one part is the confidentiality identification index information, and the other part is the confidentiality identification attribute information. The confidentiality identification index information is uniquely corresponding to the confidentiality identification attribute information. It is the confidentiality identification information in the confidentiality identification that circulates with the confidential document in the confidential information system. It is combined with the confidential document in a certain way, and then the digital signature technology in cryptography is used to ensure that the identification index cannot be tampered with and cannot be separated from the confidential document. At the same time, the identity of the identifier binder is also determined. The second part of the confidentiality level identification is the security identification attribute information stored in the database, which completely records the security, content, circulation, log and other extended attribute information of the confidential file that uniquely corresponds to the confidentiality level identification. This part of the confidentiality level identification attribute information does not circulate with the confidential file in the confidential information system, but is encrypted and signed and stored in the database. It is centrally stored and managed in the form of a database, and the association relationship between the confidential file and the confidentiality level identification is established. The mapping table is maintained in the background to make the two inseparable. At the same time, it also ensures the integrity and confidentiality of the identification attribute information in the database.

[0005] After confidential files are bound to confidentiality level identification, they can be protected to a limited extent. However, since confidential users will call up confidential files from time to time, confidentiality level identification needs to dynamically record information on the flow and use of confidential files. Therefore, confidentiality level identification information needs to be dynamically updated. In order to effectively protect the security of confidential files throughout their life cycle, a complete set of effective solutions for confidentiality level identification management is needed. Summary of the invention

[0006] The present invention provides a method and system for managing confidentiality level identification to solve the problems raised in the above background technology.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is: In a first aspect, the present invention provides a method for managing confidentiality level identification, including confidentiality level identification generation and addition, confidentiality level identification detection, and confidentiality level identification update.

[0008] A further improvement of the technical solution of the present invention is that the generation and addition of the confidentiality level identification includes the following process: A1: Creation of confidential documents; A2: Request for approval of confidential documents; A3: Integrity check; A4: Document approval; A5: Generate a File ID. A6: Generate confidentiality level identification attribute information; A7: Confidential documents are formed; A8: Digital signature.

[0009] A further improvement of the technical solution of the present invention is that the confidentiality level identification added in the confidentiality level identification detection system is divided into two parts: identification index and identification attribute information. The identification index circulates with the confidential file in the confidential information system, while the complete identification attribute information is stored in the database. Therefore, in order to read the confidentiality level identification attribute information corresponding to the confidential file one by one, it is necessary to first obtain the identification index information, and then find the corresponding identification attribute information in the database according to the File ID in the index, and finally judge the operation authority of the confidentiality level user on the confidential file through the permission information in the identification attribute.

[0010] A further improvement of the technical solution of the present invention is that the confidentiality level identification detection includes the following process: B1: User identity authentication; B2: Request for access to confidential files; B3: Get user and identification information; B4: Whether the User can open the File; B5: Whether it is ciphertext; B6: Update the confidentiality level identification attribute information; B7: Print request; B8: Update the confidentiality level identification attribute information.

[0011] A further improvement of the technical solution of the present invention is that the attribute information in the confidentiality identification in the confidentiality identification update system can be changed dynamically, especially the flow attribute information and log attribute information in the identification. They record the entire process of the circulation of confidential files in the confidential information system and the logs generated by users' operations on confidential files. This information is constantly changing during the life cycle of confidential files. This part of information is directly updated by the identification management center. If the security attribute information in the confidentiality identification of confidential files needs to be changed, it must be approved by the approval personnel and can only be updated after approval.

[0012] A further improvement of the technical solution of the present invention is that the updating of the confidentiality level identification includes the following process: C1: Request to change the identity security attribute; C2: Approval; C3: The terminal agent obtains the flow and log attribute information.

[0013] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art: The present invention provides a method and system for managing confidentiality level identification, and proposes a technical solution for generating and adding confidentiality level identification, which mainly includes the processes of creating confidential documents, approving confidential documents, checking integrity, approving documents, generating confidentiality level identification information, forming confidential documents and digital signatures.

[0014] The present invention provides a method and system for confidentiality identification management, and proposes a technical solution for confidentiality identification detection, which mainly includes processes such as user identity authentication, confidential file access request, obtaining user and identification information, whether the user can open the file, whether it is ciphertext, updating confidentiality identification attribute information, printing request and updating confidentiality identification attribute information.

[0015] The present invention provides a method and system for managing confidentiality identification, and proposes a technical solution for updating confidentiality identification, which mainly includes processes such as request for changing identification security attributes, approval, terminal agent acquisition flow and log attribute information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flow chart for generating and adding a confidentiality level identifier for the present invention; Figure 2 This is a flow chart of the confidentiality level identification detection of the present invention; Figure 3 This is the confidentiality level identification attribute information update process of the present invention. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below in conjunction with embodiments: Example 1

[0018] like Figure 1 As shown, the present invention provides a method and system for managing confidentiality level identification, including generation and addition of confidentiality level identification, detection of confidentiality level identification, and update of confidentiality level identification; The generation and addition of confidentiality level identification includes the following processes: A1: Creation of confidential documents; A confidential user in a confidential information system creates a confidential file on a confidential computer with a terminal agent installed; A2: Request for approval of confidential documents; The created confidential file sends a confidential file approval request to the confidentiality identification management center through the terminal agent. The request includes the confidentiality information, permission information and its own attribute information of the file. The file creator specifies the confidentiality level for the confidential file based on the file content and its own confidentiality level, and encrypts the file and approval information according to the default encryption, signature algorithm and key of the file confidentiality level to ensure the security of the confidential file content and approval information. A3: Integrity check; The Classification Identification Management Center receives confidential documents and information to be approved uploaded by the terminal agent, and automatically verifies their integrity and the information of the file creator. Only confidential documents that pass the integrity check can be sent to the confidential document approval process; A4: Document approval; Confidential documents that have passed the integrity check enter the confidential document approval process, and are approved in turn by the approval personnel with approval authority specified by the console. The approval content mainly includes: confidentiality information of confidential documents, validity period of confidential documents, confidentiality information of users allowed to access, and permission information such as reading, writing, and printing of confidential documents. After approval, the result is returned to the confidentiality identification management center, and the confidentiality identification management center sends a confidentiality identification generation request to the console, which includes the approval result of the confidential document and the security protection measures to be taken for the confidential document; A5: Generate a File ID. After receiving the request to generate a confidentiality identification, the console generates a File ID for the confidential file and returns it to the confidentiality identification management center together with the security protection measures required for the confidential file; A6: Generate confidentiality level identification attribute information; After completing the previous step, the console creates a corresponding confidentiality level identification for the confidential file and stores its content attributes and security attributes in the database; A7: Confidential documents are formed; After receiving the File ID and the security protection measures to be taken for confidential files from the console, the Classification Identification Management Center first encrypts them, then performs a hash operation on the encrypted file, combines it with the File ID to form an identification index, and finally adds it to the header of the confidential file to form a confidential file. At the same time, the Classification Identification Management Center also records the log information generated during the approval process in the corresponding Classification Identification attribute information; A8: Digital signature; After the confidential file is generated, the confidentiality identification management center will digitally sign it to ensure that the identification index cannot be tampered with, cannot be separated from the confidential file, and the identity of the person who added the confidentiality identification is certain.

[0019] In this embodiment, the present invention proposes a technical solution for generating and adding confidentiality level identification, which mainly includes the processes of confidential file creation, confidential file approval, integrity verification, file approval, generating confidentiality level identification information, forming confidential files and digital signatures. Example 2

[0020] like Figure 2 As shown, on the basis of Example 1, the present invention provides a technical solution: preferably, the confidentiality level identification added in the confidentiality level identification detection is divided into two parts: identification index and identification attribute information. The identification index circulates with the confidential file in the confidential information system, while the complete identification attribute information is stored in the database. Therefore, in order to read the confidentiality level identification attribute information corresponding to the confidential file one by one, it is necessary to first obtain the identification index information, and then search for the corresponding identification attribute information in the database according to the FileID in the index, and finally judge the operation authority of the confidentiality level user on the confidential file through the permission information in the identification attribute.

[0021] The confidentiality level identification detection includes the following processes: B1: User identity authentication; When a user logs into a confidential computer, he must first undergo identity authentication. Only users who pass the identity authentication can log into the confidential computer and then operate confidential files. B2: Request for access to confidential files; When a user needs to access a confidential file, the terminal agent will first detect whether the confidential file has an identification index, and also verify the integrity of the identification index bound to the confidential file. If the identification information is complete, the terminal agent will send the User ID and File ID to the identification management center. If the confidential file does not have an identification index, the terminal agent will send it to the identification management center to add the identification index information. B3: Get user and identification information; After receiving the User ID and File ID, the identification management center searches the database for user information and the confidentiality identification attribute information of the confidential file according to the User ID and File ID respectively; B4: Whether the User can open the File; After obtaining the user information and confidentiality identification attribute information, the identification management center determines whether the user can open the file based on the policy information; B5: Whether it is ciphertext; If the user can open the confidential file, the identification management center will further check the content attribute information of the confidentiality identification to see whether the confidential file is ciphertext. If it is ciphertext, it will turn to the encryption attribute information in the security attribute of the confidentiality identification to find the corresponding decryption algorithm and decryption key information to decrypt the confidential file; B6: Update the confidentiality level identification attribute information; After the file is opened, the identification management center will update the permission information part of the security attribute of the classified identification to reduce the number of times it can be accessed by one; B7: Print request; If the user wants to print confidential files, the terminal agent will send a request to the identification management center to print confidential files. The request also includes the User ID and File ID. The identification management center will determine whether the user has the permission to print the file based on the policy information, and also determine whether the terminal has the printing permission. Only when both are met can the user print the file. B8: Update the confidentiality level identification attribute information; After the user prints a confidential document, the identification management center will update the permission information part of the confidentiality identification security attributes to reduce the number of times it can be printed.

[0022] In this embodiment, the main processes include user identity authentication, confidential file access request, obtaining user and identification information, whether the user can open the file, whether it is ciphertext, updating confidentiality identification attribute information, printing request and updating confidentiality identification attribute information. Example 3

[0023] like Figure 3As shown, based on Example 1, the present invention provides a technical solution: preferably, the attribute information in the confidentiality identification during the update of the confidentiality identification can be changed dynamically, especially the flow attribute information and log attribute information in the identification, which fully record the flow process of confidential files in the confidential information system and the logs generated by users' operations on confidential files. This information is constantly changing during the life cycle of confidential files. This part of information is directly updated by the identification management center. If the security attribute information in the confidentiality identification of confidential files needs to be changed, it must be approved by the approval personnel and can only be updated after approval.

[0024] 6. A method and system for managing confidentiality level identification according to claim 1, characterized in that: updating the confidentiality level identification includes the following process: C1: Request to change the identity security attribute; When a system user needs to change the security attribute information of the confidentiality level identification of a confidential file, he first sends a request to the identification management center to change the security attribute information of the identification. C2: Approval; Requests to change the security attribute information of the classified identification must be approved by the approver. After approval, the console security administrator will update the security attribute information of the classified identification. C3: The terminal agent obtains the flow and log attribute information; When a system user operates a confidential file, the log processing module in the terminal agent uploads the user's operation log on the confidential file to the identification management center through the network. The identification management center stores it in the flow and log attributes of the identification database in the prescribed format.

[0025] In this embodiment, the present invention proposes a technical solution for updating the confidentiality level identification, which mainly includes processes such as request for changing the identification security attribute, approval, terminal agent acquisition flow and log attribute information.

[0026] Through effective management of the generation, addition, detection and update of confidentiality identification, it is ensured that the confidentiality identification fully and correctly records the log information of the generation, use, circulation, update and deletion of the confidential files bound to it, so that the confidential files can be effectively protected by the confidentiality identification throughout their life cycle.

[0027] The above generally describes the present invention in detail, but it is obvious to a person skilled in the art that some modifications or improvements can be made to the present invention. Therefore, modifications or improvements that do not depart from the spirit of the present invention are within the scope of protection of the present invention.

Claims

1. A method and system for managing confidentiality level identification, characterized by: It includes the generation and addition of confidentiality level identification, the detection of confidentiality level identification, and the updating of confidentiality level identification.

2. A method and system for managing confidentiality level identification according to claim 1, characterized in that: The generation and addition of the confidentiality level identification includes the following process: A1: Creation of confidential documents; A2: Request for approval of confidential documents; A3: Integrity check; A4: Document approval; A5: Generate a File ID. A6: Generate confidentiality level identification attribute information; A7: Confidential documents are formed; A8: Digital signature.

3. A method and system for managing confidentiality level identification according to claim 1, characterized in that: The confidentiality level identification added in the confidentiality level identification detection is divided into two parts: identification index and identification attribute information. The identification index circulates with the confidential file in the confidential information system, while the complete identification attribute information is stored in the database. Therefore, in order to read the confidentiality level identification attribute information corresponding to the confidential file one by one, it is necessary to first obtain the identification index information, and then find the corresponding identification attribute information in the database according to the FileID in the index, and finally judge the operation authority of the confidentiality user on the confidential file through the permission information in the identification attribute.

4. A method and system for managing confidentiality level identification according to claim 1, characterized in that: The confidentiality level identification detection includes the following process: B1: User identity authentication; B2: Request for access to confidential files; B3: Get user and identification information; B4: Whether the User can open the File; B5: Whether it is ciphertext; B6: Update the confidentiality level identification attribute information; B7: Print request; B8: Update the confidentiality level identification attribute information.

5. A method and system for managing confidentiality level identification according to claim 1, characterized in that: During the update of the confidentiality level identification, the attribute information in the confidentiality level identification can be changed dynamically, especially the circulation attribute information and log attribute information in the identification. They record the entire process of the circulation of confidential files in the confidential information system and the logs generated by users' operations on confidential files. This information is constantly changing during the life cycle of confidential files. This part of information is directly updated by the identification management center. If the security attribute information in the confidentiality level identification of confidential files needs to be changed, it must be approved by the approval personnel and can only be updated after approval.

6. A method and system for managing confidentiality level identification according to claim 1, characterized in that: The updating of the confidentiality level identification includes the following process: C1: Request to change the identity security attribute; C2: Approval; C3: The terminal agent obtains the flow and log attribute information.

Images