A data asset management system, method, device, storage medium and product

Abstract

The present invention discloses a data asset management system, method, device, storage medium and product, the system includes: a data asset storage layer, a data asset management application layer and a security software layer; the data asset storage layer is used to store data assets in a confidential state, and extract the first target data corresponding to the data access request in response to the data access request, perform confidential calculation on the first target data, and obtain the return data for the data access request; the data asset management application layer is used to classify and grade data assets, register and confirm ownership, evaluate quality and value assessment; the security software layer is used to perform security detection on the data access request and the first target data. The data asset management system disclosed by the present invention realizes the confidential storage and calculation of logarithmic assets through the data asset storage layer, realizes the security protection of data assets through the security software layer, and realizes the management and evaluation of data assets through the data asset management application layer.

Description

Technical Field

[0001] The present invention relates to the technical field of data asset management, and in particular to a data asset management system, method, device, storage medium and product. Background Art

[0002] Data resources can be considered as an asset and included in financial statements. The inclusion of data assets in financial statements usually involves steps such as asset registration and confirmation, asset valuation, and revenue auditing, so that their value can be reflected in financial reports. The inclusion of data assets in financial statements is highly dependent on information systems, and there are security issues in the process. Enterprises need to invest more resources and implement complex security measures to eliminate hidden dangers.

[0003] The existing protection measures for data assets are: first, using blockchain technology to submit the directory information of data assets to the alliance chain, while generating upload operation records of data assets, and submitting the records to the alliance chain; second, using storage encryption and decryption technology to encrypt data asset data when it is entered, and decrypt and return it when the user calls it.

[0004] There are two limitations in the existing solutions: First, blockchain technology is only used at the application layer to prevent tampering of asset data and operation records, while the confidentiality of data storage, transmission, and calculation processes is not protected; second, although storage encryption and decryption technology protects stored data, there is a decryption process on the server side when reading data, and there is plaintext data in devices such as the CPU and memory, which is vulnerable to side channel attacks. Summary of the invention

[0005] The present invention provides a data asset management system, method, device, storage medium and product to achieve secure storage and management of data assets.

[0006] According to one aspect of the present invention, there is provided a data asset management system, comprising: a data asset storage layer, a data asset management application layer and a security software layer;

[0007] The data asset storage layer is used to store data assets in a confidential state, and in response to a data access request, extract first target data corresponding to the data access request, perform confidential calculation on the first target data, and obtain return data for the data access request;

[0008] The data asset management application layer is used to classify and grade the data assets, register and confirm ownership, evaluate quality and assess value;

[0009] The security software layer is used to perform security detection on the data access request and the first target data.

[0010] Furthermore, the data asset storage layer is also used for:

[0011] In response to the data operation and maintenance instruction, dynamically desensitize the data asset to obtain desensitized data for the data operation and maintenance instruction;

[0012] Correspondingly, the security software layer is also used to perform security detection on the data operation and maintenance instructions.

[0013] Furthermore, the data asset storage layer includes a secret storage module, a secret computing module, a dynamic desensitization module and an encryption communication module, and the data asset storage layer is specifically used for:

[0014] Encrypting and storing the data assets through the encrypted storage module;

[0015] Determine the corresponding target operation according to the data access request by the secret computing module, extract the first target data from the secret storage module and execute the target operation to obtain the return data;

[0016] Determine the corresponding second target data and target key according to the data operation and maintenance instruction by the dynamic desensitization module, extract the second target data from the secret storage module, decrypt the second target data by the target key, and desensitize the second target data by setting a desensitization algorithm to obtain the desensitized data;

[0017] The set encryption protocol is obtained through the encryption communication module, and the message transmission channel of the data asset storage layer is encrypted through the set encryption protocol.

[0018] Furthermore, the data asset management application layer includes a classification and grading module, a data asset registration and confirmation module, a data asset quality evaluation module and a data asset value assessment module. The data asset management application layer is specifically used for:

[0019] Classify the data assets into asset categories and security levels through the classification and grading module;

[0020] Determine the data asset collection method, asset ownership and asset change information through the data asset registration and confirmation module;

[0021] Performing quality evaluation on the data assets according to set evaluation indicators through the data asset quality evaluation module;

[0022] The data asset value assessment module performs value assessment on the data asset according to a set algorithm to obtain value information of the data asset.

[0023] Furthermore, the security software layer includes an audit monitoring module, an attack detection module and a security management module, and the security software layer is specifically used for:

[0024] Collecting operation logs in the system through the audit monitoring module, and performing security audit on the operation logs according to set audit rules;

[0025] Acquire the data access request and the returned data through the attack detection module, and perform risk detection on the data access request and the returned data according to the set attack rules;

[0026] The set audit rules and the set attack rules are configured through the security management module and sent to the audit monitoring module and the attack detection module.

[0027] Furthermore, the system further comprises an isolation network layer, an operating software layer and a hardware layer, wherein the hardware layer is located at the bottom layer of the system, and the operating software layer and the isolation network layer are located above the hardware layer in sequence;

[0028] The isolation network layer is used to generate a virtual network card, so that the system can communicate internally through the virtual network card and form a logical isolation with the physical network, and perform network entry and exit detection on the data access request and the returned data respectively;

[0029] The operating software layer is used to obtain operating information and generate the data access request in response to the operating information;

[0030] The hardware layer is used to provide hardware support for the system; wherein the hardware layer includes a password card, and the password card is used to store keys and distribute them to the data asset storage layer.

[0031] Furthermore, the security software layer is also used for:

[0032] The call information of the isolation network layer and the operating software layer is obtained, and risk detection is performed on the call information.

[0033] According to another aspect of the present invention, there is provided a method for managing data assets, comprising:

[0034] In response to the data access request, performing security detection on the data access request through the security software layer;

[0035] If the detection passes, extracting the first target data corresponding to the data access request through the data asset storage layer;

[0036] Performing security detection on the first target data through a security software layer;

[0037] If the detection passes, the first target data is subjected to a secret calculation through the data asset storage layer to obtain return data for the data access request.

[0038] Furthermore, the method further comprises:

[0039] Before performing security detection on the data access request through the security software layer, performing network access detection on the data access request through the isolation network layer;

[0040] Before performing security check on the first target data through the security software layer, performing network exit check on the first target data through the isolation network layer.

[0041] Furthermore, the method further comprises:

[0042] In response to the data operation and maintenance instruction, performing security detection on the data operation and maintenance instruction through the security software layer;

[0043] If the detection passes, the second target data corresponding to the data operation and maintenance instruction is extracted through the data asset storage layer, and the second target data is dynamically desensitized to obtain the desensitized data for the data operation and maintenance instruction.

[0044] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0045] at least one processor; and

[0046] a memory communicatively connected to the at least one processor; wherein,

[0047] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data asset management method described in any embodiment of the present invention.

[0048] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data asset management method described in any embodiment of the present invention when executed.

[0049] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program / instructions, which, when executed by a processor, implement the steps of the data asset management method described in any embodiment of the present invention.

[0050] The data asset management system disclosed in the present invention comprises a data asset storage layer, a data asset management application layer and a security software layer; the data asset storage layer is used to store data assets in a confidential state, and extract the first target data corresponding to the data access request in response to the data access request, perform confidential calculation on the first target data, and obtain the return data for the data access request; the data asset management application layer is used to classify and grade data assets, register and confirm ownership, and perform quality evaluation and value assessment processing; the security software layer is used to perform security detection on the data access request and the first target data. The data asset management system disclosed in the present invention realizes the confidential storage and calculation of logarithmic assets through the data asset storage layer, realizes the security protection of data assets through the security software layer, and realizes the management and evaluation of data assets through the data asset management application layer.

[0051] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 This is a schematic diagram of the structure of a data asset management system provided according to Embodiment 1 of the present invention;

[0054] Figure 2 This is a network topology diagram of a data asset management system provided according to the first embodiment of the present invention;

[0055] Figure 3 is a flow chart of a data asset management method provided according to Embodiment 2 of the present invention;

[0056] Figure 4 is a schematic diagram of a processing process for a data access request and a data operation and maintenance instruction respectively provided according to the second embodiment of the present invention;

[0057] Figure 5 It is a schematic diagram of the structure of an electronic device for implementing the data asset management method of the third embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0059] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0060] Embodiment 1

[0061] Figure 1 This is a schematic diagram of the structure of a data asset management system provided in the first embodiment of the present invention. This embodiment is applicable to the case where data assets are managed using a data asset management system. The system can execute a data asset management method. The data asset management system can be implemented in the form of hardware and / or software. The data asset management system can be configured in an electronic device. Figure 1 As shown, the system includes: a data asset storage layer 110 , a data asset management application layer 120 and a security software layer 130 .

[0062] The data asset storage layer 110 is used to store data assets in a confidential state, and extract the first target data corresponding to the data access request in response to the data access request, perform confidential calculations on the first target data, and obtain return data for the data access request.

[0063] The data asset management application layer 120 is used to classify and grade data assets, register and confirm ownership, evaluate quality, and assess value.

[0064] The security software layer 130 is used to perform security detection on the data access request and the first target data.

[0065] Among them, the data access request can be a request for query, reading, etc. of the data assets within the system using the management system of the data asset. The first target data is the data asset required to be accessed by the data access request, and the returned data is the data returned to the user in response to the data access request.

[0066] In this embodiment, the data assets in the system are stored in the data asset storage layer 110, and the data asset storage layer 110 can encrypt the data assets. When the system receives a data access request, the security software layer 130 can first perform a security check on the request, and after confirming the legitimacy of the request, allow the request to be forwarded to the data asset storage layer 110. The data asset storage layer 110 can determine the first target data required to be accessed by the request by parsing the data access request. At the same time, the first target data must also undergo a security check by the security software layer 130 when leaving the warehouse. After determining that the first target data is allowed to leave the warehouse, the data asset storage layer 110 performs operations such as equal value query and unequal value query on the target data without decrypting it in the memory to obtain return data for the data access request.

[0067] Optionally, the data asset storage layer 110 is also used to: respond to data operation and maintenance instructions, dynamically desensitize data assets to obtain desensitized data for the data operation and maintenance instructions; correspondingly, the security software layer 130 is also used to perform security detection on the data operation and maintenance instructions.

[0068] Specifically, the data operation and maintenance instruction is an instruction for the operation and maintenance personnel to access the data assets in the data asset storage layer 110 in the scenario of database operation and maintenance. In this scenario, the operation and maintenance personnel have the authority to access the data asset storage layer 110, but do not need to see the plain text asset data. Therefore, when receiving the data operation and maintenance instruction, the security software layer 130 can first perform a security check on the instruction, and after confirming the legitimacy of the instruction, allow the instruction to be forwarded to the data asset storage layer 110. The data asset storage layer 110 can dynamically desensitize the data accessed by the data operation and maintenance instruction, and return the desensitized data after dynamic desensitization to the client that initiated the data operation and maintenance instruction.

[0069] Optionally, the data asset storage layer 110 includes a secret storage module 111, a secret computing module 112, a dynamic desensitization module 113 and an encryption communication module 114. The data asset storage layer 110 is specifically used for:

[0070] The data assets are encrypted and stored through the confidential storage module 111; the corresponding target operation is determined according to the data access request through the confidential computing module 112, the first target data is extracted from the confidential storage module 111 and the target operation is performed to obtain return data; the corresponding second target data and target key are determined according to the data operation and maintenance instructions through the dynamic desensitization module 113, the second target data is extracted from the confidential storage module 111, the second target data is decrypted by the target key, and the second target data is desensitized by the set desensitization algorithm to obtain desensitized data; the set encryption protocol is obtained through the encryption communication module 114, and the message transmission channel of the data asset storage layer is encrypted by the set encryption protocol.

[0071] Specifically, the data asset storage layer 110 can adopt a containerized deployment method to package the software code and all required components in the data asset storage layer 110 together and isolate them in their own "containers". In addition to conventional data storage, the data asset storage layer 110 can provide four security features based on the secret storage module 111, the secret computing module 112, the dynamic desensitization module 113 and the encryption communication module 114: (1) Secret storage module 111: The secret storage module 111 can encrypt and store data assets. The data stored in this module are all encrypted files at the operating system level. For attackers who do not have the decryption key, directly reading the underlying asset data files is unreadable. (2) Secret computing module 112: For sensitive data asset fields stored in secret, the secret computing module 112 can execute the target operation corresponding to the data access request without decrypting in the memory, such as common operators such as equality query, inequality query, range comparison, fuzzy query, four arithmetic operations, etc., and the implementation methods include homomorphic encryption algorithm, order-preserving encryption algorithm, etc. Among them, the key required for secret state calculation can be obtained by calling the interface of the password card. (3) Dynamic desensitization module 113: For the scenario of database operation and maintenance, the operation and maintenance personnel have the authority to access the database, but should not see the plain text asset data. In this scenario, the dynamic desensitization module 113 can parse the data operation and maintenance instructions, determine the second target data that the instruction wants to access, and determine the target key required to decrypt the second target data, and call the interface of the password card to obtain the target key. After the second target data is decrypted in the memory, the SQL execution plan can be rewritten to rewrite the value content before the result is returned to the terminal to achieve data desensitization. The desensitization algorithm can be masking, shifting, truncation, rounding, simulation, etc. The algorithm is set by the database administrator as needed through the security management software. After the desensitization is completed, the data is returned to the client that initiated the query. Since there is plain text data in the memory during the calculation process, the process can be securely monitored through the security software layer 130. (4) Encryption communication module 114: The encryption communication module 114 can encrypt all channels for transmitting messages with the data asset storage layer 110 according to the set encryption protocol, so that even if an attacker enters the device to intercept the message, he cannot decrypt it to obtain the real asset information. For example, the encryption protocol used by the encryption communication module 114 can be TLS (Transport Layer Security), which is a security protocol that provides security and data integrity for network communications. It aims to provide confidentiality, data integrity and authenticity between two communicating applications, and ensures that the communication data is not eavesdropped, tampered with or forged during transmission by using a variety of encryption technologies, such as symmetric encryption, asymmetric encryption and hash functions.

[0072] Furthermore, for the data asset management system, the data generated in each application and module of the system must be stored in the secret storage module 111 of the data asset storage layer 110 to ensure security. During the data writing process, the encrypted asset data metadata can be written by calling the password card to obtain the key; during the asset data reading process, the secret storage module 111 returns the ciphertext result according to the data access request, and then returns the plaintext to the application after decryption by calling the password card to obtain the key.

[0073] Optionally, the data asset management application layer 120 includes a classification and grading module 121, a data asset registration and confirmation module 122, a data asset quality evaluation module 123 and a data asset value evaluation module 124. The data asset management application layer 120 is specifically used for: classifying data assets into asset categories and security levels through the classification and grading module 121; determining the data asset collection method, asset ownership and asset change information through the data asset registration and confirmation module 122; performing quality evaluation on data assets according to set evaluation indicators through the data asset quality evaluation module 123; and performing value evaluation on data assets according to a set algorithm through the data asset value evaluation module 124 to obtain value information of the data assets.

[0074] Specifically, above the data asset storage layer 110 is the data asset management application layer 120. The data asset management application layer 120 includes various data asset management modules deployed in a containerized manner: (1) Classification and grading module 121: The classification and grading module 121 can classify a given data asset into asset categories and security levels. The basis for the asset category and security level classification is the standards of the industry to which each enterprise belongs, and is identified by the metadata name, annotation, and actual data content of the asset. The result of the asset category and security level classification can be a data file at the table level or file level. The asset category and security level classification of data assets can effectively identify data asset risks, and then impose protection measures on certain data assets in compliance with compliance requirements. (2) Data asset registration and confirmation module 122: The data asset registration and confirmation module 122 can enter the basic information of data assets, clarify the data asset collection method and asset ownership and asset change information, and record asset change information when data assets change, so as to solve the problem of market access for property rights confirmation of data resources. (3) Data asset quality evaluation module 123: The data asset quality evaluation module 123 can evaluate the quality of data assets according to the set evaluation indicators, where the set evaluation indicators may include indicators in terms of accuracy, completeness, consistency, reliability and timeliness, thereby outputting the quality evaluation results in terms of accuracy, completeness, consistency, reliability and timeliness of the assets. (4) Data asset value evaluation module 124: The data asset value evaluation module 124 can quantitatively evaluate the enterprise data assets through set algorithms such as cost method, income method, market method, etc., and output the value information of the data assets after calculation. This process requires the input of the cost information of the data assets, as well as the blood relationship information of the processing and consumption of the data assets. The output results of the four modules of the data asset management application layer 120 together constitute the security and business attributes, rights and responsibilities attributes, quality attributes and value attributes of the data assets, completing the comprehensive definition of data assets.

[0075] Optionally, the security software layer 130 includes an audit monitoring module 131, an attack detection module 132 and a security management module 133. The security software layer 130 is specifically used for:

[0076] The operation logs in the system are collected through the audit monitoring module 131, and security audits are performed on the operation logs according to the set audit rules. The data access requests and return data are obtained through the attack detection module 132, and risk detection is performed on the data access requests and return data according to the set attack rules. The audit rules and attack rules are configured and set through the security management module 133, and sent to the audit monitoring module 131 and the attack detection module 132.

[0077] Specifically, the security software layer 130 includes three modules, which respectively integrate three types of vertical security software:

[0078] (1) Audit monitoring module 131. The security software integrated in the audit monitoring module 131 is an audit monitoring engine, which can collect operation logs in the system through system bypass, such as operating system software, container call logs, SQL logs of the data asset storage layer 110, and operation audit logs of various applications and modules in the data asset management application layer 120. Among them, the operating system software and container logs can be obtained by collecting syslog, and the SQL logs of the data asset storage layer 110 are stored in the log file in the form of text files. The various modules in the data asset management application layer 120 can be in the same process or deployed in the form of microservices, but they are unified as B / S deployment architectures, and the call details must be recorded and output in the log file after all interface calls. The audit monitoring engine can monitor the changes in the logs and incrementally record various operations of users in the system. Further, according to the set audit rules, certain forms of log content can be defined as security risks.

[0079] (2) Attack detection module 132. The security software integrated in the attack detection module 132 is a facet attack detection engine. In the system call, facets are embedded in the container runtime, data asset storage layer 110 and each application interface layer in the data asset management application layer 120 of the system, and combined with the log information imported by the audit monitoring module 131, the preset attack rules are matched to confirm whether the data access request and the corresponding return data are risky. When there is a risk of data leakage or tampering, the attack detection module 132 can detect it and block the relevant behavior through the facet. For example: if there is a non-database process trying to read the database file in the operating system, this behavior will be identified as data theft by the operating system layer facet, and the behavior will be recorded and blocked; if the interface of the data asset management application layer 120 receives an illegal character message, this behavior will be judged as unauthorized penetration by the application layer facet, and the behavior will be recorded and blocked. Preferably, for operating system software and containers, eBPF technology (Extended Berkeley Packet Filter, a sandbox technology running in the Linux kernel) can be used to collect function calls made by the data asset management application layer 120 to the operating system software, including calls made by the container daemon process; for the data asset storage layer 110 and the data asset management application layer 120, agent technology in programming languages ​​can be used, such as Java agent and Gohook framework to implant event detection logic. When events such as network packet sending, child process calling, file handle operation, etc. occur, the agent will send the message to the aspect attack detection engine, and the engine will traverse the above-mentioned feature library to determine whether it constitutes a security incident.

[0080] (3) Security management module 133. The security software integrated in the security management module 133 is a security management tool software, which can be used to display the security status of the all-in-one machine, configure and issue the audit rules and attack rules required for security detection by the audit monitoring module 131 and the attack detection module 132, and can also be used to configure and issue the dynamic desensitization strategy required for dynamic desensitization by the dynamic desensitization module 113. The rules and strategies can be issued in such a way that the audit monitoring module 131, the attack detection module 132 and the dynamic desensitization module 113 obtain them through an internally reserved interface. If the rules and strategies need to be updated or adjusted, the security management module 133 can also push these data to each module through an internally reserved interface.

[0081] Optionally, the system also includes an isolated network layer 140, an operating software layer 150 and a hardware layer 160, wherein the hardware layer 160 is located at the bottom layer of the system, and above the hardware layer 160 are the operating software layer 150 and the isolated network layer 140 in sequence; the isolated network layer 140 is used to generate a virtual network card, allowing the system to communicate through the virtual network card and form a logical isolation with the physical network; the operating software layer 150 is used to obtain operation information and generate data access requests in response to the operation information; the hardware layer 160 is used to provide hardware support for the system; wherein the hardware layer 160 includes a password card 161, which is used to store keys and distribute them to the data asset storage layer 110.

[0082] Specifically, the bottom layer of the management system of this data asset is the hardware layer 160, which includes a password card 161, which can be used to store keys. When the secret computing module 112 and the dynamic desensitization module 113 perform dynamic desensitization of the secret computer, the key required for decrypting the data can be obtained by calling the interface of the password card. In addition to the password card 161, the hardware layer 160 can also include hardware devices such as CPU, memory hard disk, network card, etc., which are used to provide hardware support for the system. The upper layer of the hardware layer is the operating software layer 150, which supports container virtualization technology and can be used to obtain operation information and generate data access requests in response to operation information. Above the operating software layer 150 is the isolation network layer 140, which can generate a virtual network card based on the physical network card. The virtual network card and the physical network card are in different IP segments. A virtual switch is created between the two through overlay network technology (such as VXLAN, GENEVE, etc.) to achieve logical isolation from the physical network outside the device.

[0083] Furthermore, the security software layer 130 is also used to obtain the call information of the isolation network layer 140 and the operating software layer 150, and perform risk detection on the call information.

[0084] Specifically, the security software layer 130 can collect the call information of the isolated network layer 140 and the operating software layer 150 through the attack detection module 132, and confirm whether there is a risk in the call information of the isolated network layer 140 and the operating software layer 150 according to the preset attack rules. When there is a risk of data leakage or tampering, the attack detection module 132 can find it and block the relevant behavior through the aspect.

[0085] Furthermore, enterprises usually store data assets in a data warehouse and data lake for unified storage. The data warehouse and data lake are separately planned data production domains located in the production network segment. In order to ensure the independence of financial auditing, when deploying the management system of this data asset, it should not be deployed in the production domain, but is more suitable to be deployed in the data analysis domain. Figure 2 A network topology diagram of a data asset management system provided for an embodiment of the present invention is shown in the figure. The data analysis domain is usually in the office network segment. Data analysts can process the original data to generate new assets that can be entered into the table. Financial personnel can read the assets in the data warehouse and data lake in the domain for statistics, organize the metadata used for asset entry, and use it as a basis for value assessment. The management system of this data asset should not be unconditionally exposed to the office network segment. A data management domain can be divided into an internal container overlay network. The network access policy must be enabled during deployment: only the terminal IP of financial auditors is allowed to log in to the data asset management application layer, only the terminal IP of IT personnel is allowed to log in to the security software layer, and only some tools are allowed to access the data warehouse and data lake in the data production domain to perform data sampling as their functional dependency data. The detailed network access policy settings are shown in the following table (excluding temporary access due to operation and maintenance needs):

[0086] Table 1 Network access strategy

[0087]

[0088] The data asset management system provided by the embodiment of the present invention includes a data asset storage layer, a data asset management application layer and a security software layer; the data asset storage layer is used to store data assets in a confidential state, and extract the first target data corresponding to the data access request in response to the data access request, perform confidential calculations on the first target data, and obtain the return data for the data access request; the data asset management application layer is used to classify and grade data assets, register and confirm rights, evaluate quality and value assessment; the security software layer is used to perform security detection on the data access request and the first target data. The data asset management system disclosed in the present invention realizes the confidential storage and calculation of logarithmic assets through the data asset storage layer, prevents the plaintext leakage of data assets, realizes the security protection of data assets through the security software layer, identifies, blocks and records external attacks, and realizes the management and evaluation of data assets through the data asset management application layer. Further, the software in this system can be deployed in a containerized manner, run under a logical network, and be independently deployed in an office network segment, and can realize access rights control of data assets by configuring fine-grained network access policies.

[0089] Embodiment 2

[0090] Figure 3 This is a flow chart of a data asset management method provided in the second embodiment of the present invention. This embodiment is applicable to the case where a data asset management system is used to manage data assets. The method can be executed by the data asset management system. Figure 3 As shown, the method includes:

[0091] S110 . In response to a data access request, perform security detection on the data access request through a security software layer.

[0092] Among them, data access requests are requests for querying, reading, etc. of data assets within the system.

[0093] In this embodiment, when a data access request is received, the security software layer may perform a security check on the request to confirm the legitimacy of the request.

[0094] Preferably, the security software layer includes an attack detection module, which can perform cross-sectional attack detection on data access requests according to set attack rules.

[0095] S120: If the detection passes, extract the first target data corresponding to the data access request through the data asset storage layer.

[0096] The first target data is the data asset that the data access request requires access to.

[0097] In this embodiment, if the security check on the data access request passes, the first target data to be accessed by the request can be determined by parsing the data access request, and the first target data corresponding to the data access request can be extracted through the data asset storage layer.

[0098] S130. Perform security detection on the first target data through the security software layer.

[0099] In this embodiment, when the data assets in the data asset storage layer are released from the warehouse, the data needs to be security checked to ensure that the data is allowed to be released from the warehouse. After the data asset storage layer extracts the first target data corresponding to the data access request, the security software layer can perform a section attack detection on the first target data according to the set attack rules through the attack detection module.

[0100] S140: If the detection passes, a confidential calculation is performed on the first target data through the data asset storage layer to obtain return data for the data access request.

[0101] Among them, the data asset storage layer includes a confidential computing module, which can execute the target operation corresponding to the data access request without decrypting in the memory, such as equality query, inequality query, range comparison, fuzzy query, etc.

[0102] In this embodiment, after the data access request and the corresponding first target data pass the security check, the data asset storage layer can call the key through the secret computing module and execute the operator corresponding to the data access request to obtain the return data.

[0103] Furthermore, before performing a security check on the data access request through the security software layer, a network access check can also be performed on the data access request through the isolated network layer; before performing a security check on the first target data through the security software layer, a network exit check can also be performed on the first target data through the isolated network layer.

[0104] In this embodiment, the management system of this data asset can achieve logical isolation between the internal network of the system and the physical network outside the system through the isolation network layer. When a data access request is received, the request can first perform a network access check on the data access request through the isolation network layer before entering the system. If the check passes, the data access request can then be subjected to a facet attack check through the security software layer. Only if all the checks pass can the data be accessed in the system data asset storage layer. Similarly, after determining the first target data that the data access request requires to be accessed, the first target data can also be subjected to a network access check through the isolation network layer, and then a facet attack check can be performed on the first target data through the security software layer. Only if all the checks pass can the data be returned to the data request end.

[0105] Furthermore, the method also includes: in response to the data operation and maintenance instructions, performing security checks on the data operation and maintenance instructions through the security software layer; if the check passes, extracting the second target data corresponding to the data operation and maintenance instructions through the data asset storage layer, and dynamically desensitizing the second target data to obtain desensitized data for the data operation and maintenance instructions.

[0106] In this embodiment, the data operation and maintenance instruction is an instruction for the operation and maintenance personnel to access the data assets in the data asset storage layer in the scenario of database operation and maintenance. In this scenario, the operation and maintenance personnel have the authority to access the data asset storage layer, but do not need to see the plain text asset data. Therefore, when receiving the data operation and maintenance instruction, the security software layer can first perform a security check on the instruction, and after confirming the legitimacy of the instruction, allow the instruction to be forwarded to the data asset storage layer. The data asset storage layer can dynamically desensitize the data accessed by the data operation and maintenance instruction, and return the desensitized data after dynamic desensitization to the client that initiated the data operation and maintenance instruction.

[0107] Furthermore, after receiving a data operation and maintenance instruction, the instruction can first perform a network access check on the data access request through the isolated network layer before entering the system. If the check passes, the data access request can be subjected to a cross-sectional attack check through the security software layer. Only if all the checks pass can the instruction enter the system data asset storage layer to access data.

[0108] Figure 4 This is a schematic diagram of a processing process for data access requests and data operation and maintenance instructions respectively provided by an embodiment of the present invention. As shown in the figure, for data access requests, a network access detection is first performed through the isolated network layer, and then a section attack detection is performed through the security software layer. After both tests are passed, the first target data required to be accessed by the data access request is determined. Then, the network access detection and section attack detection are performed on the first target data respectively. After both tests are passed, a secret state calculation is performed through the data asset storage layer, and the data is returned to the data request end. For data operation and maintenance instructions, a network access detection is first performed through the isolated network layer, and then a section attack detection is performed through the security software layer. After both tests are passed, the data asset storage layer performs dynamic desensitization processing on the data accessed by the data operation and maintenance instructions, and finally returns the desensitized data to the client that initiated the data operation and maintenance instructions.

[0109] The data asset management method provided in the embodiment of the present invention can be executed by the data asset management system provided in any embodiment of the present invention, and has corresponding functional modules and beneficial effects.

[0110] Embodiment 3

[0111] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0112] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0113] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0114] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a data asset management method.

[0115] In some embodiments, the data asset management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the management of the data assets described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the data asset management method in any other appropriate manner (e.g., by means of firmware).

[0116] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0118] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0120] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0121] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0122] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0123] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data asset management system, characterized in that: include: Data asset storage layer, data asset management application layer and security software layer; The data asset storage layer is used to store data assets in a confidential state, and in response to a data access request, extract first target data corresponding to the data access request, perform confidential calculation on the first target data, and obtain return data for the data access request; The data asset management application layer is used to classify and grade the data assets, register and confirm ownership, evaluate quality and assess value; The security software layer is used to perform security detection on the data access request and the first target data.

2. The system according to claim 1, characterized in that The data asset storage layer is also used for: In response to the data operation and maintenance instruction, dynamically desensitize the data asset to obtain desensitized data for the data operation and maintenance instruction; Correspondingly, the security software layer is also used to perform security detection on the data operation and maintenance instructions.

3. The system according to claim 2, characterized in that The data asset storage layer includes a secret storage module, a secret calculation module, a dynamic desensitization module and an encryption communication module. The data asset storage layer is specifically used for: Encrypting and storing the data assets through the encrypted storage module; Determine the corresponding target operation according to the data access request by the secret computing module, extract the first target data from the secret storage module and execute the target operation to obtain the return data; Determine the corresponding second target data and target key according to the data operation and maintenance instruction by the dynamic desensitization module, extract the second target data from the secret storage module, decrypt the second target data by the target key, and desensitize the second target data by setting a desensitization algorithm to obtain the desensitized data; The set encryption protocol is obtained through the encryption communication module, and the message transmission channel of the data asset storage layer is encrypted through the set encryption protocol.

4. The system according to claim 1, characterized in that The data asset management application layer includes a classification and grading module, a data asset registration and confirmation module, a data asset quality evaluation module and a data asset value assessment module. The data asset management application layer is specifically used for: Classify the data assets into asset categories and security levels through the classification and grading module; Determine the data asset collection method, asset ownership and asset change information through the data asset registration and confirmation module; Performing quality evaluation on the data assets according to set evaluation indicators through the data asset quality evaluation module; The data asset value assessment module performs value assessment on the data asset according to a set algorithm to obtain value information of the data asset.

5. The system according to claim 1, characterized in that The security software layer includes an audit monitoring module, an attack detection module and a security management module. The security software layer is specifically used for: Collecting operation logs in the system through the audit monitoring module, and performing security audit on the operation logs according to set audit rules; Acquire the data access request and the returned data through the attack detection module, and perform risk detection on the data access request and the returned data according to the set attack rules; The set audit rules and the set attack rules are configured through the security management module and sent to the audit monitoring module and the attack detection module.

6. The system according to claim 1, characterized in that The system further comprises an isolation network layer, an operating software layer and a hardware layer, wherein the hardware layer is located at the bottom layer of the system, and the operating software layer and the isolation network layer are arranged above the hardware layer in sequence; The isolation network layer is used to generate a virtual network card, so that the system can communicate internally through the virtual network card and form a logical isolation with the physical network, and perform network entry and exit detection on the data access request and the returned data respectively; The operating software layer is used to obtain operating information and generate the data access request in response to the operating information; The hardware layer is used to provide hardware support for the system; wherein the hardware layer includes a password card, and the password card is used to store keys and distribute them to the data asset storage layer.

7. The system according to claim 6, characterized in that The security software layer is also used to: Acquire call information of the isolation network layer and the operating software layer, and perform risk detection on the call information.

8. A data asset management method, characterized in that: include: In response to the data access request, performing security detection on the data access request through the security software layer; If the detection passes, extracting the first target data corresponding to the data access request through the data asset storage layer; Performing security detection on the first target data through a security software layer; If the detection passes, the first target data is subjected to a secret calculation through the data asset storage layer to obtain return data for the data access request.

9. The method according to claim 8, characterized in that Also includes: Before performing security detection on the data access request through the security software layer, performing network access detection on the data access request through the isolation network layer; Before performing security check on the first target data through the security software layer, performing network exit check on the first target data through the isolation network layer.

10. The method according to claim 8, characterized in that Also includes: In response to the data operation and maintenance instruction, performing security detection on the data operation and maintenance instruction through the security software layer; If the detection passes, the second target data corresponding to the data operation and maintenance instruction is extracted through the data asset storage layer, and the second target data is dynamically desensitized to obtain the desensitized data for the data operation and maintenance instruction.

11. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data asset management method described in any one of claims 8-10.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data asset management method described in any one of claims 8 to 10 when executed.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the data asset management method as described in any one of claims 8 to 10 are implemented.

Images