A method and device for real-time analysis of whether sensitive data is leaked on a cross-border data link

Abstract

This invention discloses a method and apparatus for real-time assessment of whether sensitive data leakage exists on cross-border data links. The method includes: acquiring sensitive sample data from a data provider; constructing a target policy database based on the sensitive sample data; responding to a cross-border data access message request from the data provider; determining the actual security policy executed by the cross-border data access message request; and recording the policy execution content and corresponding execution results of the actual security policy as execution log information in the gateway log of the data gateway; and determining the cross-border data assessment result based on the execution log information and the target security policy database. This invention, through the above technical solution, can prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and achieve real-time data access monitoring, automatic alarms, and risk control.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and device for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link. Background Art

[0002] Assume that there are two parties, A and B, each with different regulations regarding data outbound transfer, and A and B need to share some data. How can A and B share data while satisfying their respective relevant regulations and ensure the security of data processing and data transmission?

[0003] In the existing technology, manual identification is usually used to check the outbound data when the data is outbound. This method cannot change the rules in real time and requires many manual operations, resulting in low efficiency and low cross-border transmission security. Therefore, there is an urgent need for a method to solve the problem of how cross-border enterprises can judge in real time whether there is sensitive data leakage in the data transmission link and take timely protective measures. Summary of the invention

[0004] In view of this, the present invention provides a method and device for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link, which can prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and realize real-time data access monitoring and automatic alarm and risk control.

[0005] According to one aspect of the present invention, an embodiment of the present invention provides a method for real-time analysis and judgment of whether sensitive data leakage exists on a cross-border data link. The method is applied to a sandbox, and the sandbox includes a security protection center and a data gateway; the method includes:

[0006] Acquire sensitive sample data from a data provider, and build an expected policy database based on the sensitive sample data; wherein the sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; the expected policy database includes sensitive data and corresponding expected security policies;

[0007] In response to the cross-border data access message request corresponding to the data provider, determine the actual security policy executed by the cross-border data access message request, and record the policy execution content and corresponding execution result of the actual security policy as execution log information in the gateway log of the data gateway;

[0008] The cross-border data analysis results are determined based on the execution log information and the expected security policy database.

[0009] According to another aspect of the present invention, an embodiment of the present invention further provides a device for real-time analysis and judgment of whether sensitive data leakage exists on a cross-border data link, the device is applied to a sandbox, the sandbox includes a security protection center and a data gateway; the device includes:

[0010] An expected policy determination module is used to obtain sensitive sample data from a data provider and build an expected policy database based on the sensitive sample data; wherein the sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; and the expected policy database includes sensitive data and corresponding expected security policies;

[0011] An actual policy determination module, used to determine the actual security policy executed by the cross-border data access message request corresponding to the data provider in response to the cross-border data access message request, and record the policy execution content and corresponding execution result of the actual security policy as execution log information in the gateway log of the data gateway;

[0012] The analysis and judgment result determination module is used to determine the cross-border data analysis and judgment results based on the execution log information and the expected security policy database.

[0013] According to another aspect of the present invention, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link as described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link as described in any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, an embodiment of the present invention further provides a computer program product, characterized in that the computer program product includes a computer program, and when the computer program is executed by a processor, the method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link as described in any embodiment of the present invention is implemented.

[0019] The above-mentioned technical scheme of the embodiment of the present invention builds an expected policy database through sensitive sample data, which can realize the identification and hierarchical classification of sensitive data in multiple industries and languages, and automatically recommend adaptive security policies; by determining the actual security policy executed by the cross-border data access message request, and recording the policy execution content of the actual security policy and the corresponding execution result as execution log information in the gateway log of the data gateway; based on the execution log information, and the expected security policy database, the cross-border data analysis results are determined, which can prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and realize real-time data access monitoring and automatic alarm and risk control.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link provided by an embodiment of the present invention;

[0023] Figure 2 A flowchart of another method for real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link provided by an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of a process of forming an expected strategy database provided by an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of a process for real-time analysis and judgment of sensitive data leakage and protection measures on a data flow link provided by an embodiment of the present invention;

[0026] Figure 5 A schematic diagram of a process for determining a cross-border data analysis result provided by an embodiment of the present invention;

[0027] Figure 6 It is a structural block diagram of a device for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link provided by an embodiment of the present invention;

[0028] Figure 7A schematic diagram of the structure of an electronic device provided for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] The acquisition, storage, use, and processing of data in the technical solution of this application comply with relevant regulations.

[0032] In one embodiment, Figure 1 A flowchart of a method for real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link is provided for one embodiment of the present invention. This embodiment can be applied to situations in which real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link is performed. The method can be performed by a device for real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link. The device for real-time analysis and determination of whether sensitive data has been leaked on a cross-border data link can be implemented in the form of hardware and / or software.

[0033] like Figure 1 As shown, the method is applied to a sandbox, which includes a security protection center and a data gateway; the method includes:

[0034] S110: Acquire sensitive sample data from a data provider, and build an expected strategy database based on the sensitive sample data.

[0035] The sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; the expected policy database includes sensitive data and corresponding expected security policies. It can be understood that each different type of sensitive data corresponds to a corresponding expected security policy.

[0036] In this embodiment, the data provider provides sensitive sample data to the sandbox in the supervision center. By identifying the language types corresponding to the sensitive sample data, the corresponding natural language processing models are set according to different languages ​​to process different languages ​​for feature extraction. Due to cross-border transmission, the industry standards corresponding to different regions are different. A corresponding data model can be set for different industries for feature classification of the industry, so that the business type based on industry and feature classification can be analyzed from the sample data. Based on the classified data sensitivity level analysis, the engine will be able to evaluate the sensitivity of the data and classify it according to its potential impact and risk on the business and customer privacy. In some embodiments, for each sensitive data business type, a pre-trained semantic analysis model is used to perform semantic analysis on the sensitive sample data of different sensitive data business types to obtain the corresponding semantic analysis results. The result of the semantic analysis is to extract the sensitive data in the sample data, including the metadata of the data object (such as data source, library table column), and the classification and grading information of the data; based on the semantic analysis results, a targeted expected security policy is selected, and the API provided by the data gateway is called to send the security policy to the data gateway, and the semantic analysis results corresponding to each sensitive data and the corresponding expected security policy are formed into an expected policy database and saved to the security protection center.

[0037] S120. In response to the cross-border data access message request corresponding to the data provider, determine the actual security policy executed by the cross-border data access message request, and record the policy execution content and corresponding execution results of the actual security policy as execution log information in the gateway log of the data gateway.

[0038] Among them, the cross-border data access message request may carry the access type, access time, access meta information, access session ID and other information of this access. The actual security policy can be understood as the security policy actually implemented for the cross-border data access message request. The actual security policy in this embodiment may include but is not limited to dynamic desensitization, static desensitization, data encryption, prohibited access, plaintext access and desensitized access.

[0039] In this embodiment, the policy execution content may include but is not limited to release, deny access, desensitization, data encryption and other execution methods. The execution result may also be called the effectiveness result, which may include two modes: successful execution or failed execution.

[0040] In this embodiment, in response to the cross-border data access message request corresponding to the data provider, the cross-border data access message request can be parsed to obtain the data metadata corresponding to the message, including the data source and library list, and the session id. In this embodiment, it is necessary to first determine the actual security policy executed by the cross-border data access message request, and then record the policy execution content of the actual security policy and the corresponding execution result as the execution log information in the gateway log of the data gateway for subsequent use. In some embodiments, the cross-border data access message request can be parsed to obtain the corresponding access type, so that the security policy execution is selected from the preset security policy according to the access type, so that the executed security policy is used as the actual security policy actually executed, wherein the preset security policy can include dynamic desensitization, static desensitization, data encryption, prohibited access, plaintext access and desensitized access. It can be understood that whether direct access, prohibited access or desensitization is determined according to the access type, the policy content (release, rejection or desensitization) and the effectiveness result (success or failure) are recorded in the gateway log. In this embodiment, the log adopts the JSON format that is easy to deserialize and expand attributes to facilitate subsequent log analysis and auditing. For example, if the access type is desensitized, the corresponding desensitization algorithm and parameters will be applied to desensitize the cross-border data access message request.

[0041] S130. Determine the cross-border data analysis result based on the execution log information and the expected security policy database.

[0042] The results of cross-border data analysis can include access denial and access permission. When access is denied, it is determined that sensitive data has been leaked, and certain measures need to be taken to prevent data transmission.

[0043] In this embodiment, the cross-border data analysis result can be determined through the execution log information composed of the policy execution content of the actual security policy and the corresponding execution result, as well as the various types of sensitive data stored in the expected security policy database and the corresponding meta information, sensitive data level and category. In some embodiments, the execution log information is parsed to obtain the meta information corresponding to the cross-border data access message request; it is determined whether the meta information is the meta information agreed upon by the preset sensitive rule; if not, it is determined that the second meta information allows access; if so, it is further determined whether the second meta information is in the preset white list. If the second meta information is not in the preset white list, the actual security policy corresponding to the access message request is determined from the execution log information, and the API interface of the security protection center is called to search the first meta information identical to the second meta information in the expected policy database through the API interface and the second meta information, and determine the sensitive data level, category and expected security policy corresponding to the first meta information, compare the expected security policy with the actual execution policy to obtain the comparison result, and determine the cross-border data analysis result based on the comparison result. In other embodiments, the data to be transmitted is sent to an analysis engine, so that the analysis engine analyzes the data to be transmitted; the analysis result of the analysis engine is received, and if the analysis result indicates that the data to be transmitted includes sensitive data, the sensitive data is intercepted. This embodiment is not limited here.

[0044] The above-mentioned technical scheme of the embodiment of the present invention builds an expected policy database through sensitive sample data, which can realize the identification and hierarchical classification of sensitive data in multiple industries and languages, and automatically recommend adaptive security policies; by determining the actual security policy executed by the cross-border data access message request, and recording the policy execution content of the actual security policy and the corresponding execution result as execution log information in the gateway log of the data gateway; based on the execution log information, and the expected security policy database, the cross-border data analysis results are determined, which can prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and realize real-time data access monitoring and automatic alarm and risk control.

[0045] In one embodiment, after determining the cross-border data analysis result, the following is further included:

[0046] Generate different levels of alarm events based on the results of cross-border data analysis, and push different levels of alarm events to the supervision center so that the supervision center can execute response measures according to the preset alarm strategy;

[0047] Among them, the preset alarm strategy includes at least one of the following: automatic blocking, manual review, and record audit.

[0048] In this embodiment, according to the policy comparison results and the severity of the leakage, different levels of alarm events are generated and pushed to the supervision center. Once a potential data leakage is detected, an alarm can be generated and measures such as automatic blocking can be taken to reduce the risk of data leakage, that is, the supervision center can take corresponding response measures according to the preset alarm strategy. In this embodiment, the severity of the leakage can be known through the data classification information corresponding to the expected strategy of this session in the database. For example, once an alarm occurs, B's further access to A's data can be immediately blocked to prevent the leakage of sensitive data. The supervision center can set a variety of alarm strategies, such as automatic blocking, manual review, record audit, etc., to meet different business needs and security requirements.

[0049] In one embodiment, after building the expected strategy database based on the sensitive sample data, the method further includes:

[0050] The semantic analysis results of the sensitive data contained in the expected policy database are transmitted to the regulatory center and the data provider so that the regulatory center and the data provider can review the semantic analysis results, and the unified review results of the regulatory center and the data provider are stored in the expected security policy database.

[0051] In this embodiment, after building the expected policy database based on the sensitive sample data, the semantic analysis results of the sensitive data contained in the expected policy database need to be transmitted to the supervision center and the data provider, so that the supervision center and the data provider can review the semantic analysis results, and store the unified review results of the supervision center and the data provider in the expected security policy database. It can be understood that the analysis results need to be reviewed by the supervision center and the data provider at the same time, and manual adjustments can be made during the review process to reach a final consensus. In this embodiment, the supervision center can audit, review, and manually adjust the semantic analysis and classification and grading results, and can also define which data needs to be constrained by rules and the access specifications that need to be followed to access the data. In addition, logs can be audited, alarm policies can be set, and manual intervention can be made when necessary, providing additional security protection.

[0052] In one embodiment, Figure 2 A flowchart of another method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link provided by an embodiment of the present invention. Based on the above embodiments, this embodiment further refines the construction of an expected policy database based on sensitive sample data, the determination of the actual security policy executed by the cross-border data access message request, and the determination of the cross-border data analysis results based on the execution log information and the expected security policy database.

[0053] like Figure 2As shown, the method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link in this embodiment may specifically include the following steps:

[0054] S210: Acquire sensitive sample data from a data provider, identify the language types corresponding to the sensitive sample data, and select different natural language processing models for different language types to perform feature extraction on the sensitive sample data.

[0055] In this embodiment, the natural language processing model is a natural language processing (NLP) model based on deep learning, which adopts the Transformer architecture and is pre-trained on a large-scale corpus. It can simultaneously take into account the context of all words in a sentence. After identifying the language types corresponding to the sensitive sample data, different natural language processing models can be selected to perform feature extraction on sensitive sample data of different language types to support sensitive data identification in a multi-language environment.

[0056] S220. Identify the sensitive data business type corresponding to the sensitive sample data after feature extraction.

[0057] In this embodiment, the sensitive data business type can be a variety of business types, for example, user personal information type, medical health type, user behavior data type, geographic location data, social media data, etc., which are not limited in this embodiment. In this embodiment, for sensitive sample data after feature extraction, the sensitive data business type corresponding to the sensitive sample data after feature extraction is first identified to facilitate subsequent processing.

[0058] S230. For each sensitive data business type, use a pre-trained semantic analysis model to perform semantic analysis on sensitive sample data of different sensitive data business types to obtain corresponding semantic analysis results.

[0059] The semantic analysis result includes at least the first meta information corresponding to the sensitive data, the sensitive data level, and the category; the first meta information includes at least: a data source and a library list.

[0060] In this embodiment, different semantic analysis models are selected for different sensitive data business types. It can be understood that for each type of sensitive data, different semantic analysis models are used to perform semantic analysis on sensitive sample data. For each sensitive data business type, a pre-trained semantic analysis model is used to perform semantic analysis on sensitive sample data of different sensitive data business types to obtain corresponding semantic analysis results. Of course, when training the semantic analysis model, different sensitive data business types correspond to a unique semantic analysis model and are trained separately. It can be understood that when training the semantic analysis model, relevant business type data is first collected, and the collected relevant business type data is labeled to mark which ones are sensitive data and which ones are not sensitive data. If it is sensitive data, the sensitive data type and the field to which the sensitive data belongs can be labeled as a training sample set, so as to train the semantic analysis model to obtain a trained allegorical analysis model. This embodiment will not be described one by one.

[0061] S240. Select a corresponding expected security policy based on the semantic analysis result.

[0062] In this embodiment, the first metadata, sensitive data level, and category corresponding to the sensitive data included in the semantic analysis result are used to recommend the corresponding expected security strategy. The expected security strategy includes at least: dynamic desensitization, static desensitization, data encryption, and access control; access control includes prohibited access, plaintext access, and desensitized access.

[0063] S250. After the expected security policy is reviewed by the supervision center and the data provider, the semantic analysis results corresponding to each sensitive data and the corresponding expected security policy are formed into an expected policy database and saved in the security protection center.

[0064] In this embodiment, after the expected security policy is reviewed by the supervision center and the data provider, the semantic analysis results corresponding to each sensitive data and the corresponding expected security policy are formed into an expected policy database and saved to the security protection center. It can be understood that the security policy needs to be reviewed and manually adjusted by the supervision center and the data provider before it can be issued. In addition, in order to ensure the security of API calls in the sandbox, a variety of measures can be taken, including using HTTPS for data transmission encryption, configuring network and API access policies to restrict only the security protection center to call specific APIs of the data gateway.

[0065] In this embodiment, before cross-border data access occurs, A's sensitive data is identified and defined through semantic analysis, and security policies are configured and issued for the sensitive data. The security policies can be universal or different policies can be configured for different access parties.

[0066] For example, in order to better understand the definition of sensitive data in the security protection center before cross-border data access, and the issuance of expected security policies corresponding to sensitive data, Figure 3 FIG. 1 is a schematic diagram of a process of forming an expected strategy database provided by an embodiment of the present invention. Figure 3 As shown, the security protection center has three built-in modules: semantic analysis engine, sensitive data management, and security policy management. The data gateway has a built-in security policy execution module. To obtain sensitive sample data from data provider A, the semantic analysis engine has built-in models for multiple official and commonly used languages ​​to support sensitive data identification in multi-language environments; for data models of different industries, the business type of data based on industry and feature classification can be analyzed from sample data; based on classified data sensitivity level analysis, the engine will be able to evaluate the sensitivity of the data and classify it according to its potential impact and risks on the business and user privacy, and finally obtain sensitive data, including classification and grading information and source information (data source, library table columns) of sensitive data. After the sensitive data is defined, the security protection center will recommend the expected security policy based on the classification and grading information of the data, and call the API provided by the data gateway to issue the security policy to the data gateway.

[0067] S260: In response to the cross-border data access message request corresponding to the data provider, perform message parsing on the access message request to obtain a parsing result.

[0068] In this embodiment, in response to a cross-border data access message request corresponding to a data provider, the access message request is parsed to obtain a parsing result; wherein the parsing result includes at least: an access type, second meta information and an access session ID corresponding to the access message request; the second meta information includes at least: a request data source and a library list corresponding to the access message request.

[0069] S270: Determine the actual security policy to be actually executed according to the access type, and use the actual security policy to perform data processing of the access message request.

[0070] In this embodiment, the actual security policy to be executed is determined based on the access type, and the actual security policy is used to perform data processing of the access message request. For example, if the access type is direct access, direct release is performed; if it is prohibited access, access denial is performed; if it is desensitization processing, a desensitization algorithm is first used to desensitize the sensitive data in the message. These are all stored in the gateway log as the policy content and execution results of the security policy execution.

[0071] S280. Call the gateway log query interface and use the session ID in the cross-border data access message request to query the corresponding execution log information.

[0072] In this embodiment, the gateway log query interface is called, and the session ID in the cross-border data access message request is used to query the corresponding execution log information, wherein the gateway log query interface is in asynchronous IO mode, which does not affect the performance of data access.

[0073] S290. Parse the execution log information to obtain the second metadata corresponding to the cross-border data access message request.

[0074] In this embodiment, the execution log information is parsed to obtain the second meta information corresponding to the cross-border data access message request; wherein the second meta information at least includes the request data source and the library list.

[0075] S2100, determining whether the second meta information is meta information specified by a preset sensitivity rule, if not, executing S2110; if yes, executing S2120.

[0076] Among them, the preset sensitive rules are sensitive rules defined by users themselves, which may include relevant rules prohibiting access to sensitive data in certain specific scenarios, and can be set according to needs.

[0077] In this embodiment, it is determined whether the second meta information is the meta information stipulated by the preset sensitive rule. If not, it is determined that the second meta information is allowed to access. If so, it is further determined whether the second meta information is in the preset white list. If the second meta information is not in the preset white list, the actual security policy corresponding to the access message request is determined from the execution log information, and the API interface of the security protection center is called to search the first meta information identical to the second meta information in the expected policy database through the API interface and the second meta information, and determine the sensitive data level, category and expected security policy corresponding to the first meta information, compare the expected security policy with the actual execution policy to obtain the comparison result, and determine the cross-border data judgment result based on the comparison result. It can be understood that if the second meta information is the meta information stipulated by the preset sensitive rule, the subsequent white list, expected and actual policy comparison and other processes are carried out for judgment; if it does not match the meta information stipulated by the sensitive rule, it means that the rule constraint is not the object to be accessed by the cross-border data access message request, so there is no need to do policy comparison, and access is directly allowed.

[0078] S2110: Determine whether the second metadata is allowed to be accessed.

[0079] In this embodiment, when the second meta information is not the meta information specified by the preset sensitivity rule, it is determined that the second meta information is allowed to be accessed.

[0080] S2120. Continue to determine whether the second meta information is in the preset whitelist. If the second meta information is not in the preset whitelist, determine the actual security policy corresponding to the access message request from the execution log information, and call the API interface of the security protection center to search for the first meta information that is the same as the second meta information in the expected policy database through the API interface and the second meta information, and determine the sensitive data level, category and expected security policy corresponding to the first meta information, compare the expected security policy with the actual execution policy to obtain a comparison result, and determine the cross-border data analysis result based on the comparison result.

[0081] In this embodiment, if the second meta-information is the meta-information agreed upon by the preset sensitive rule, it is further determined whether the second meta-information is in the preset whitelist. If the second meta-information is not in the preset whitelist, the actual security policy corresponding to the access message request is determined from the execution log information, and the API interface of the security protection center is called to search the first meta-information identical to the second meta-information in the expected policy database through the API interface and the second meta-information, and determine the sensitive data level, category and expected security policy corresponding to the first meta-information, compare the expected security policy with the actual execution policy to obtain the comparison result, and determine the cross-border data judgment result based on the comparison result. It can be understood that the API of the security protection center is called to obtain the sensitive data type and expected policy involved in this data access. The rule analysis engine compares the expected policy with the actual policy. If the two do not match, it is determined that sensitive data leakage may have occurred. In this embodiment, based on the leakage judgment logic of the comparison between the expected policy and the actual policy, combined with the whitelist mechanism, it is accurately judged whether there is a risk of data leakage, reducing false alarms and improving security.

[0082] In one embodiment, the preset whitelist is a predefined list of trusted entities, and the rules established by the entity list include at least one of the following: allowing specified users and / or user groups to access data; allowing specified IP addresses and / or IP address ranges to access data; allowing access to data within a specified preset time period; allowing specified entities to access specified data objects and / or data sets.

[0083] In this embodiment, the whitelist is part of the security policy, which defines a list of entities that are considered safe or trusted, which can bypass certain security controls and allow access to the system or data without additional verification. In the scenario of cross-border data, the whitelist mechanism can provide more refined and flexible data access control to avoid unnecessary alarms. The application dimensions of the whitelist mechanism may include but are not limited to: User-based whitelist: Allow specific users or user groups to access sensitive data. This usually involves user authentication and authorization, where only authenticated and authorized users can access specific data resources. IP-based whitelist: Allow specific IP addresses or IP address ranges to access sensitive data. Whitelist based on periodic time periods: Allow access to data during specific time periods. For example, access to sensitive data may be allowed only during working hours on weekdays, and access is prohibited at other times. This control can help reduce potential security risks during non-working hours. Data object-based whitelist: Set a whitelist for specific data objects or data sets to allow specific entities to access these specific data.

[0084] In this embodiment, before cross-border data access, the regulatory center can configure sensitive data access rules, which define which data needs to be constrained by the rules and the access specifications based on security policies that need to be followed when accessing the data. When cross-border data access occurs, the built-in interceptor of the gateway intercepts the message, parses the log, and analyzes the rules. If the analysis result shows that the data access violates the rules, an alarm is generated and pushed to the regulatory center, and countermeasures such as automatically blocking the access party from continuing to access the data are taken.

[0085] For example, to better understand the real-time analysis of sensitive data leakage and protection measures in the data flow link, Figure 4 A flowchart of a method for real-time analysis and judgment of sensitive data leakage and protection measures on a data flow link provided by an embodiment of the present invention is provided. Figure 5 A schematic diagram of a process for determining cross-border data analysis results provided in accordance with an embodiment of the present invention.

[0086] like Figure 4As shown in the figure, in the scenario of data outbound from A to B, a security protection center and a data gateway device are provided in the sandbox of the supervision center. Taking the dynamic desensitization security policy as an example, the scenario of real-time analysis and judgment of sensitive data leakage and protection measures on the data flow link is explained. When A sends a data access request to B, the data metadata corresponding to this message, including the data source and library list, is parsed. According to the issued dynamic desensitization security policy, it is decided whether to directly access, prohibit access or perform desensitization processing according to the access type. If the access type is desensitization, the corresponding desensitization algorithm and parameters are applied to process the sensitive data, and the policy content (release, rejection or desensitization) and the effective result (success or failure) are recorded in the gateway log. The desensitized data message will be intercepted by the next interceptor and enter the rule analysis stage. The input of the rule analysis engine includes the metadata of the accessed data object, the expected policy from the security protection center, and the actual policy parsed from the gateway log. By calling the gateway log query interface, the session ID is used to query the actual policy-related logs of the accessed data, and the API of the security protection center is called to obtain the sensitive data types and expected policies involved in this data access, and the expected policies are compared with the actual policies. If the two do not match, it is determined that sensitive data leakage may have occurred. According to the policy comparison results and the severity of the leakage, different levels of alarm events are generated and pushed to the supervision center. The supervision center can take corresponding response measures according to the preset alarm strategy.

[0087] like Figure 5 As shown in the figure, the process of determining the results of cross-border data analysis is as follows:

[0088] a1. Parse cross-border data access messages to obtain metadata corresponding to the access;

[0089] a2. Determine whether the meta information is the meta information specified by the preset sensitive rule. If not, execute a6; if yes, execute a3;

[0090] a3: Whether the meta information is in the preset whitelist; if yes, execute a6; if not, execute a4;

[0091] a4. Determine the actual security policy corresponding to the access message request from the execution log information, and call the API interface of the security protection center to search for the same meta-information as the meta-information in the expected policy database through the API interface and meta-information, and determine the sensitive data level, category and expected security policy corresponding to the same meta-information as the meta-information;

[0092] a5. Compare the expected security policy with the actual implementation policy and determine whether the comparison result is consistent; if consistent, execute a6; if inconsistent, execute a7;

[0093] a6. Access is allowed;

[0094] a7. Trigger a data leakage alarm and deny access.

[0095] The above technical solution of this embodiment uses a pre-trained semantic analysis model to perform semantic analysis on sensitive sample data of different sensitive data business types for each sensitive data business type, selects the corresponding expected security policy according to the semantic analysis result, and forms an expected policy database, which can realize the identification and classification of multi-industry and multi-language sensitive data, and automatically recommends adaptive security policies; on this basis, the cross-border data access message request is parsed to obtain the parsing result, and the actual security policy actually executed is determined according to the access type, thereby parsing the execution log information to obtain the second meta information corresponding to the cross-border data access message request, and when the second meta information is not the meta information stipulated by the preset sensitive rule and the preset white list, the actual security policy corresponding to the access message request is determined from the execution log information, and the first meta information identical to the second meta information is searched in the expected policy database through the API interface and the second meta information, thereby determining the corresponding sensitive data level, category and expected security policy, comparing the expected security policy with the actual execution policy to obtain the comparison result, and determining the cross-border data judgment result according to the comparison result, which can further prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and realize real-time data access monitoring and automatic alarm and risk control.

[0096] In one embodiment, Figure 6 This is a structural block diagram of a device for real-time analysis and judgment of whether sensitive data is leaked on a cross-border data link provided by an embodiment of the present invention. The device is suitable for real-time analysis and judgment of whether sensitive data is leaked on a cross-border data link. The device can be implemented by hardware / software. Figure 6 As shown, the device includes: an expected strategy determination module 610, an actual strategy determination module 620 and a judgment result determination module 630.

[0097] The expected policy determination module 610 is used to obtain sensitive sample data from a data provider and build an expected policy database based on the sensitive sample data; wherein the sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; and the expected policy database includes sensitive data and corresponding expected security policies;

[0098] The actual policy determination module 620 is used to determine the actual security policy executed by the cross-border data access message request corresponding to the data provider in response to the cross-border data access message request, and record the policy execution content and corresponding execution result of the actual security policy as execution log information in the gateway log of the data gateway;

[0099] The analysis result determination module 630 is used to determine the cross-border data analysis result based on the execution log information and the expected security policy database.

[0100] In this embodiment, the expected policy determination module builds an expected policy database through sensitive sample data, which can realize the identification and classification of sensitive data in multiple industries and languages, and automatically recommend adaptive security policies; the actual policy determination module determines the actual security policy executed by the cross-border data access message request, and records the policy execution content of the actual security policy and the corresponding execution results as execution log information in the gateway log of the data gateway; the judgment result determination module determines the cross-border data judgment result based on the execution log information and the expected security policy database, which can prevent the leakage of sensitive data, improve the security of data transmission, ensure data security, and realize real-time data access monitoring and automatic alarm and risk control.

[0101] In one embodiment, the device further comprises:

[0102] An alarm module is used to generate alarm events of different levels according to the cross-border data analysis results after determining the cross-border data analysis results, and push the alarm events of different levels to the supervision center so that the supervision center executes response measures according to the preset alarm strategy;

[0103] Among them, the preset alarm strategy includes at least one of the following: automatic blocking, manual review, and record audit.

[0104] In one embodiment, the device further comprises:

[0105] An audit module is used to transmit the semantic analysis results of the sensitive data contained in the expected policy database to the supervision center and the data provider after the expected policy database is built based on the sensitive sample data, so that the supervision center and the data provider can audit the semantic analysis results, and store the unified audit results of the supervision center and the data provider in the expected security policy database.

[0106] In one embodiment, the expected strategy determination module 610 includes:

[0107] An extraction unit, used to identify the language types corresponding to the sensitive sample data, and select different natural language processing models for different language types to perform feature extraction on the sensitive sample data;

[0108] A type identification unit, used to identify the sensitive data service type corresponding to the sensitive sample data after the feature extraction;

[0109] An analysis unit is used to perform semantic analysis on the sensitive sample data of the different sensitive data business types using a pre-trained semantic analysis model for each of the sensitive data business types, and obtain corresponding semantic analysis results; wherein the semantic analysis results at least include first meta information corresponding to the sensitive data, the level of the sensitive data, and the category; wherein the first meta information at least includes: a data source and a library list;

[0110] A policy determination unit, configured to select a corresponding expected security policy according to the semantic analysis result; wherein the expected security policy includes at least: dynamic desensitization, static desensitization, data encryption, and access control; the access control includes prohibited access, plaintext access, and desensitized access;

[0111] The audit unit is used to form an expected policy database with the semantic analysis results corresponding to each sensitive data and the corresponding expected security policy after the expected security policy has been audited by the supervision center and the data provider, and save it to the security protection center.

[0112] In one embodiment, the actual strategy determination module 620 includes:

[0113] A parsing unit, configured to parse the access message request to obtain a parsing result; wherein the parsing result at least includes: an access type, second meta information and an access session ID corresponding to the access message request; the second meta information at least includes: a request data source and a library list corresponding to the access message request;

[0114] A policy execution unit is used to determine the actual security policy to be actually executed according to the access type, and use the actual security policy to execute data processing of the access message request.

[0115] In one embodiment, the analysis result determination module 630 includes:

[0116] A query unit, used to call the gateway log query interface and use the session ID in the cross-border data access message request to query the corresponding execution log information;

[0117] A parsing unit, configured to parse the execution log information to obtain second meta information corresponding to the cross-border data access message request; wherein the second meta information at least includes a request data source and a library list;

[0118] A judging unit, used to judge whether the second meta information is meta information specified by a preset sensitivity rule;

[0119] a first result unit, for determining, if no, that the second metadata is allowed to be accessed;

[0120] The second result unit is used to continue to determine whether the second meta-information is in the preset whitelist. If the second meta-information is not in the preset whitelist, the actual security policy corresponding to the access message request is determined from the execution log information, and the API interface of the security protection center is called to search the expected policy database for the first meta-information that is the same as the second meta-information through the API interface and the second meta-information, and determine the sensitive data level, category and expected security policy corresponding to the first meta-information, compare the expected security policy with the actual execution policy to obtain a comparison result, and determine the cross-border data analysis result based on the comparison result.

[0121] In one embodiment, the preset whitelist is a predefined trusted entity list, and the rules set by the entity list include at least one of the following:

[0122] Allowing specified users and / or user groups to access data;

[0123] Allow specified IP addresses and / or IP address ranges to access data;

[0124] Allow access to data for a specified preset time period;

[0125] Allows the specified entity to access the specified data objects and / or data sets.

[0126] The device for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link provided by an embodiment of the present invention can execute the method for real-time analysis and judgment of whether there is sensitive data leakage on a cross-border data link provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0127] In one embodiment, Figure 7 A schematic diagram of the structure of an electronic device provided for implementing an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0128] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0129] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0130] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for determining in real time whether there is a sensitive data leak on a cross-border data link.

[0131] In some embodiments, the method for real-time analysis of whether there is a sensitive data leak on a cross-border data link can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for real-time analysis of whether there is a sensitive data leak on a cross-border data link described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute a method for real-time analysis of whether there is a sensitive data leak on a cross-border data link by any other appropriate means (for example, by means of firmware).

[0132] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0133] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0134] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0135] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0136] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0137] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0138] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0139] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for real-time analysis of whether sensitive data is leaked on a cross-border data link, characterized in that: Applied to the sandbox, the method comprises: Acquire sensitive sample data from a data provider, and build an expected policy database based on the sensitive sample data; wherein the sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; the expected policy database includes sensitive data and corresponding expected security policies; In response to the cross-border data access message request corresponding to the data provider, determine the actual security policy executed by the cross-border data access message request, and record the policy execution content and corresponding execution result of the actual security policy as execution log information in the gateway log of the data gateway; The cross-border data analysis results are determined based on the execution log information and the expected security policy database.

2. The method according to claim 1, characterized in that: After determining the results of cross-border data research, it also includes: Different levels of alarm events are generated according to the cross-border data analysis results, and the alarm events of different levels are pushed to the supervision center so that the supervision center executes response measures according to the preset alarm strategy.

3. The method according to claim 1, characterized in that After the expected strategy database is constructed based on the sensitive sample data, the method further includes: The semantic analysis results of the sensitive data contained in the expected policy database are transmitted to the supervision center and the data provider so that the supervision center and the data provider can review the semantic analysis results, and the unified review results of the supervision center and the data provider are stored in the expected security policy database.

4. The method according to claim 1, characterized in that: The constructing of an expected strategy database based on the sensitive sample data includes: Identify the language types corresponding to the sensitive sample data, and select different natural language processing models for different language types to perform feature extraction on the sensitive sample data; Identify the sensitive data business type corresponding to the sensitive sample data after the feature extraction; For each of the sensitive data business types, a pre-trained semantic analysis model is used to perform semantic analysis on the sensitive sample data of the different sensitive data business types to obtain corresponding semantic analysis results; wherein the semantic analysis results at least include first meta information corresponding to the sensitive data, the sensitive data level, and the category; wherein the first meta information at least includes: a data source and a library list; Selecting a corresponding expected security policy according to the semantic analysis result; wherein the expected security policy includes at least: dynamic desensitization, static desensitization, data encryption, and access control; the access control includes prohibited access, plaintext access, and desensitized access; After the expected security policy is reviewed by the supervision center and the data provider, the semantic analysis results corresponding to each sensitive data and the corresponding expected security policy are formed into an expected policy database and saved in the security protection center.

5. The method according to claim 1, characterized in that The determining the actual security policy executed by the cross-border data access message request includes: Parsing the cross-border data access message request to obtain a parsing result; wherein the parsing result at least includes: an access type, second meta information and an access session ID corresponding to the cross-border data access message request; the second meta information at least includes: a request data source and a library list corresponding to the cross-border data access message request; An actual security policy to be actually executed is determined according to the access type, and the actual security policy is used to execute data processing of the access message request.

6. The method according to claim 1, characterized in that The cross-border data analysis result is determined based on the execution log information and the expected strategy database, including: Call the gateway log query interface and use the session ID in the cross-border data access message request to query the corresponding execution log information; Parsing the execution log information to obtain second meta information corresponding to the cross-border data access message request; wherein the second meta information at least includes a request data source and a library list; Determining whether the second meta information is meta information specified by a preset sensitivity rule; If not, determining that the second metadata is allowed to be accessed; If so, continue to determine whether the second meta-information is in the preset whitelist. If the second meta-information is not in the preset whitelist, determine the actual security policy corresponding to the access message request from the execution log information, and call the API interface of the security protection center to search for the first meta-information that is the same as the second meta-information in the expected policy database through the API interface and the second meta-information, and determine the sensitive data level, category and expected security policy corresponding to the first meta-information, compare the expected security policy with the actual execution policy to obtain a comparison result, and determine the cross-border data analysis result based on the comparison result.

7. The method according to claim 6, characterized in that The preset whitelist is a predefined list of trusted entities, and the rules set by the entity list include at least one of the following: Allowing specified users and / or user groups to access data; Allow specified IP addresses and / or IP address ranges to access data; Allow access to data for a specified preset time period; Allows the specified entity to access the specified data object and / or data set.

8. A device for real-time analysis of whether sensitive data is leaked on a cross-border data link, characterized in that: Applied to a sandbox, the device comprises: An expected policy determination module is used to obtain sensitive sample data from a data provider and build an expected policy database based on the sensitive sample data; wherein the sensitive sample data includes sensitive data corresponding to at least two business types in at least two languages; and the expected policy database includes sensitive data and corresponding expected security policies; An actual policy determination module is used to determine the actual security policy executed by the cross-border data access message request corresponding to the data provider in response to the cross-border data access message request, and record the policy execution content and corresponding execution result of the actual security policy as execution log information in the gateway log of the data gateway; The analysis and judgment result determination module is used to determine the cross-border data analysis and judgment results based on the execution log information and the expected security policy database.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method described in any one of claims 1-7 for real-time analysis of whether there is sensitive data leakage on a cross-border data link.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to implement any one of claims 1-7 for real-time analysis of whether there is sensitive data leakage on a cross-border data link.

11. A computer program product, characterized in that The computer program product includes a computer program, which, when executed by a processor, implements a method for real-time analysis and determination of whether there is sensitive data leakage on a cross-border data link according to any one of claims 1 to 7.

Images