Security data processing method, data security sandbox system, equipment and medium

Abstract

The invention provides a security data processing method, a data security sandbox system, equipment and a medium. The method comprises the following steps: acquiring original data, performing protocol identification on the original data, and accessing the original data in a remote or webpage form according to a protocol identification result; running the sandbox instance, executing related business operation on the original data through the target application, and realizing data isolation through the sandbox instance; wherein the target application comprises a business scene application supporting AI modeling and a data analysis application; and carrying out real-time recording operation and monitoring on the operation of the sandbox instance based on a preset security policy, and storing a data file obtained by carrying out business operation on the sandbox instance in a specified data output directory on the premise of ensuring data security. The data security sandbox disclosed by the invention can support scenes such as data sharing, data analysis and data mining of various protocols, different industries and different services, and meets the requirements of different users.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a secure data processing method, a data security sandbox system, a device and a medium. Background Art

[0002] With the rapid development of the digital economy, data has become the core asset of various institutions. As the basis for the transformation to digitalization and intelligence, it has profoundly affected production, circulation, consumption, management and other aspects.

[0003] Current data security sandbox products and technologies are mainly used in isolated environments for machine learning modeling or joint modeling scenarios, and there are also some sandboxes for analyzing malicious code. However, these technologies cannot quickly and efficiently support scenarios such as data sharing, data analysis, and data mining in different industries, different businesses, and different protocols. Summary of the invention

[0004] The embodiment of the present invention provides a method for processing secure data to solve the problems existing in the related art. The technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a method for processing secure data, including:

[0006] Obtaining original data, performing protocol identification on the original data, and accessing the original data remotely or via a web page based on the protocol identification results;

[0007] Run the sandbox instance, perform relevant business operations on the original data through the target application, and implement data isolation through the sandbox instance; the target application includes business scenario applications that support AI modeling and data analysis applications;

[0008] Based on the preset security policy, the operation of the sandbox instance is recorded and monitored in real time. Under the premise of ensuring data security, the data files obtained by the sandbox instance executing business operations are stored in the specified data output directory, and the output files are encrypted, compressed and packaged.

[0009] In one implementation, the method for performing protocol identification on raw data is:

[0010] Determine whether the original data is a remote connection protocol or an online interactive protocol;

[0011] Remote connection protocols include RDP protocol, VNC protocol, SSH protocol, TELNET protocol and K8S protocol;

[0012] Online interactive protocols include Jupyter protocols.

[0013] In one embodiment, the method for accessing the original data in remote or web form according to the protocol identification result is:

[0014] The original data is a remote connection protocol, and the data security sandbox accesses and controls the remote through the Guacamole Server;

[0015] The original data is an online interactive protocol, and the data security sandbox is directly opened and run in the form of a WEB page.

[0016] In one implementation, the method for creating a sandbox instance is:

[0017] Create a container instance and install the pre-selected target application, and perform related business operations through the target application; allocate independent input and output data directories for each sandbox instance, and configure data volumes or storage for each sandbox instance to achieve network isolation, data isolation, and identity isolation; among them, the input directory is mounted read-only, and the output directory is mounted in normal read-write mode.

[0018] In one embodiment, when running the sandbox instance, the method further includes:

[0019] Verify the access rights of the sandbox instance to check whether the sandbox instance can be accessed;

[0020] After the access permission is verified, the connection information with the sandbox instance is initialized based on the http protocol, and a check is made as to whether the Guacamole agent is used to connect to the sandbox instance. If so, the Guacamole Server service is connected, and communication is performed through Guacd and the RDP / VNC protocol. If the communication is performed through the online interactive protocol, the JupyterNotebook service is directly connected.

[0021] In one embodiment, the security policy includes using access IP rule restrictions and sandbox data file permission settings.

[0022] In one embodiment, real-time recording of operations and monitoring also includes:

[0023] When it is determined that the sandbox instance has abnormal operating behavior during use, data protection measures are executed, including disconnecting the session, revoking permissions and issuing alarms.

[0024] In a second aspect, an embodiment of the present invention provides a data security sandbox system that executes the above-mentioned secure data processing method.

[0025] In a third aspect, an embodiment of the present invention provides an electronic device, the device comprising: a memory and a processor. The memory and the processor communicate with each other through an internal connection path, the memory is used to store instructions, the processor is used to execute the instructions stored in the memory, and when the processor executes the instructions stored in the memory, the processor executes the method in any one of the above-mentioned embodiments.

[0026] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a computer, the method in any one of the above-mentioned embodiments is executed.

[0027] The advantages or beneficial effects of the above technical solution include at least:

[0028] The present invention can realize multiple protocol identification, identify and prevent various threat behaviors through comprehensive analysis of multiple protocol data, and improve data security and network defense capabilities;

[0029] Through technologies such as data isolation and behavioral analysis, the possibility of misjudging normal data as threat data is reduced, and the accuracy and reliability of the system are improved;

[0030] Data security sandbox technology can support business scenario applications of AI modeling such as deep learning and machine learning algorithms. It can also support data science analysis business scenarios in various industries by integrating data analysis applications such as SPSS, SAS, and DataWand, thereby realizing a multi-scenario data security sandbox; enabling the data security sandbox to support multiple protocols and data sharing, data analysis, and data mining scenarios in different industries and businesses to meet the needs of different users.

[0031] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present invention and should not be regarded as limiting the scope of the present invention.

[0033] Figure 1 It is a flow chart of a secure data processing method based on a data security sandbox of the present invention;

[0034] Figure 2A schematic diagram of the creation process of a sandbox instance of the present invention;

[0035] Figure 3 A schematic diagram of the use process of the sandbox example of the present invention;

[0036] Figure 4 The overall architecture of the data security sandbox system supporting multiple protocols and multiple scenarios of the present invention;

[0037] Figure 5 This is a schematic diagram of the interaction between modules of the data security sandbox system supporting multiple protocols and multiple scenarios of the present invention; Figure 6 The structure block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0039] Embodiment 1

[0040] This embodiment provides a secure data processing method based on a data security sandbox, the purpose of which is as follows:

[0041] Provides a data security protection technology that can adapt to scenarios such as data sharing, data analysis, and data mining in different industries, different businesses, and different protocols. This technology improves data security and network defense capabilities by comprehensively analyzing multiple protocol data, and uses data isolation technology to effectively avoid data cross-interference and reduce the misjudgment rate.

[0042] At the same time, the behavior analysis system can identify abnormal behaviors in real time and take security strategies in time to ensure data security. This technology can also be widely used in various network environments, providing an effective solution for protecting data security.

[0043] The practical application of this technology can meet the needs of data sharing, data analysis, data mining and other scenarios in different industries and businesses, and provide strong support for ensuring data security. For example, in the financial industry, this technology can be applied to transaction data analysis and risk control; in the medical industry, it can be applied to medical record data sharing and medical research; in the e-commerce industry, it can be applied to user behavior analysis and marketing promotion. Through this technology, different industries and different businesses can share and analyze data in a secure environment, thereby achieving data-driven decision support and promoting business development and innovation.

[0044] Therefore, data security sandbox technology that supports multiple protocols and multiple scenarios is a technology with important practical significance. It can adapt to the data processing needs of different industries and different businesses, improve data security and network defense capabilities, and provide effective security protection and support for scenarios such as data sharing, data analysis, and data mining.

[0045] In order to provide a data security protection technology that can adapt to scenarios such as data sharing, data analysis, and data mining in different industries, different businesses, and different protocols. This embodiment proposes a secure data processing method, system, electronic device, and storage medium that supports multiple protocols and multiple scenarios. By supporting data security sandbox technology in a manner that supports multiple protocols and multiple scenarios, in order to improve data security and network defense capabilities, it supports multiple protocols and multiple scenarios, reduces the misjudgment rate, and improves data processing efficiency and system performance. This technology can provide users with more secure and efficient data processing services and ensure data security, which is of great significance and has broad application prospects.

[0046] refer to Figure 1 As shown, the security data processing method of this embodiment includes:

[0047] Obtaining original data, performing protocol identification on the original data, and accessing the original data remotely or via a web page based on the protocol identification results;

[0048] Run the sandbox instance, perform relevant business operations on the original data through the target application, and implement data isolation through the sandbox instance; the target application includes business scenario applications that support AI modeling and data analysis applications;

[0049] Based on the preset security policy, the operation of the sandbox instance is recorded and monitored in real time. Under the premise of ensuring data security, the data files obtained by the sandbox instance executing business operations are stored in the specified data output directory, and the output files are encrypted, compressed and packaged.

[0050] The data security sandbox system inputs the original data of different protocols through the interface to achieve data isolation and protection for multiple protocols. Before inputting the original data, data encryption and desensitization operations must be implemented through technical means such as data desensitization, Hash / MD5, and differential privacy.

[0051] The protocols supported by the data security sandbox are generally divided into two categories: one is the remote connection protocol, including the RDP protocol, VNC protocol, SSH protocol, TELNET protocol, and K8S protocol; the other is the online interactive protocol, including the Jupyter protocol. During the protocol identification process of the original data, the data security sandbox accesses and controls the remote connection protocol data through the Guacamole Server; for the online interactive protocol, the data security sandbox is directly opened in the form of WEB, and the code is directly written and run in the page. The above technologies are used to support and identify data security sandboxes of different protocols.

[0052] Data isolation is achieved by running a sandbox instance and performing relevant business operations on the original data through the target application of the sandbox instance.

[0053] The data security sandbox system uses container technology to deploy an independent computing environment for each sandbox instance to achieve network isolation, data isolation, and identity isolation. Container instances created through container engines such as Docker, Podman, and Kubernetes allocate independent input and output data directories for each sandbox instance. Data volumes or storage are configured separately for each sandbox instance to prevent cross-access and contamination of data from multiple sandbox instances. The input directory is mounted read-only, and the output directory is mounted in normal read-write mode. The above mechanism ensures that the data flows of different sandbox instances are completely isolated.

[0054] Security policies are mainly used to restrict the use of access IP rules and sandbox data file permissions to limit abnormal operations of sandbox instances during use. Among them, the use of access IP rules can set a corresponding whitelist, which only allows specified IP addresses or address segments to access the sandbox instance; or by setting the container to read-only mount, the sandbox is set to have only read operation permissions and cannot delete or modify data. In addition, the sandbox instance is recorded and monitored in real time, such as real-time online monitoring and input directory file monitoring. If abnormal data operations are found, the corresponding security policies are adopted to implement corresponding data protection measures, such as disconnecting sessions, revoking permissions, and issuing alarms, to ensure data security.

[0055] Under the premise of ensuring data security, the data files obtained by the sandbox instance executing business operations are output from the data security sandbox system to support scenarios such as data sharing, data analysis, and data mining. That is, the data files calculated in the data sandbox instance are stored in the specified data output directory, and the security sandbox system encrypts, compresses and packages the output files to achieve desensitization and security protection of the output data.

[0056] In one embodiment, if Figure 2 As shown in the figure, the process of creating a sandbox instance of the data security sandbox is as follows:

[0057] Create a container instance and install the pre-selected target application, and perform related business operations through the target application; allocate independent input and output data directories for each sandbox instance, and configure data volumes or storage for each sandbox instance to achieve network isolation, data isolation, and identity isolation; among them, the input directory is mounted read-only, and the output directory is mounted in normal read-write mode.

[0058] Before creating a container instance, select the data security sandbox protocol in the data security sandbox management system, select the data security sandbox operating platform, and finally select the data security sandbox operating environment and basic applications, and then schedule the data security sandbox plug-in to create an instance.

[0059] The data security sandbox creates container instances based on container engines such as Docker / Podman / Kubernetes, pulls images from the image application center based on pre-selected applications, safely installs applications, and starts images.

[0060] Container instances created by container engines such as Docker, Podman, and Kubernetes allocate independent input and output data directories for each sandbox instance. Each sandbox instance is configured with a separate data volume or storage. The input directory is mounted read-only, and the output directory is mounted with ordinary read-write to achieve directory mapping with the host machine. For example, a hospital administrator uploads clinical medical data to the input directory of the data security sandbox, and a scientific research institution enters the data security sandbox Web operation interface for scientific research analysis, and finally stores the analysis data in the output directory, and then downloads the file in the Web interface for paper publishing, etc. In the above process, a scientific research institution cannot take away clinical medical data, but can extract scientific research analysis statistics.

[0061] Finally, the data security sandbox management system monitors the operation of the data security sandbox instance through the sandbox plug-in to determine the status of the data sandbox instance.

[0062] In one embodiment, if Figure 3 As shown, the usage process of the data security sandbox running instance is as follows:

[0063] In the data security sandbox management system, select the sandbox instance where the data security sandbox is running, and verify the access rights of the data security sandbox instance through the data security sandbox management system to check whether the data security sandbox instance can be accessed.

[0064] After the access permission is verified, the data security sandbox management system initializes the connection information based on the http protocol and checks whether the Guacamole agent is connected to the sandbox instance. If the Guacamole agent is used to connect to the data sandbox, it connects to the Guacamole Server service and communicates with remote protocols such as RDP / VNC through the Guacd service; if it is through the online interactive protocol, it directly connects to the Jupyter Notebook service. Use the above two methods to access the data security sandbox instance using a web browser.

[0065] In the data security sandbox management system, upload the original data to the input directory of the sandbox instance. The input directory is set as a read-only directory by mounting the container read-only to prevent the input data from being modified. The read-only original data can be viewed in the sandbox instance. In the sandbox instance, use the relevant application or programming language to develop code for business operations and calculations, and perform data exploration research, AI modeling and other operations.

[0066] Finally, after the operation is completed, you can save the calculated output file to the output directory and download the output file of the sandbox instance in the data security sandbox management system.

[0067] After the sandbox instance is used, the data security sandbox management system can schedule the data security sandbox plug-in to stop or destroy the data security sandbox instance so that the system can release resources.

[0068] Embodiment 2

[0069] This embodiment provides a data security sandbox system that executes the security data processing method described in the first embodiment.

[0070] refer to Figure 4 As shown in the figure, the data security sandbox system includes five modules: data security sandbox web interface, data security sandbox management system, Guacamole Server service, sandbox instance running cluster, and mirror application center. The functions and interaction processes of each module are as follows:

[0071] The data security sandbox web interface requests the data security sandbox management system to obtain access rights, initializes connection information, and sends the connection information of the sandbox instance to the Guacamole Server service proxy to connect and access the sandbox instance. The Guacamole Server service uses built-in plug-ins to access sandbox instances of protocols such as RDP protocol, VNC protocol, SSH protocol, TELNET protocol, and K8S protocol.

[0072] The sandbox instance running cluster is composed of multiple servers. After the data security sandbox management system enters the server information of the sandbox instance running cluster, the sandbox plug-in is sent to each server. After the server runs the sandbox plug-in service, it communicates with the data security sandbox management system and uploads the resource information of the server and the resource information occupied by the running sandbox instance in real time.

[0073] Among them, when a server creates a sandbox instance, it needs to first request the sandbox plug-in on the server to execute the command to create a sandbox instance. The sandbox plug-in then executes the installation of the selected application script, pulls the basic image from the image application center, configures the data volume, sets the data input and output directory mapping relationship, and finally calls the container engine such as Docker, Podman, Kubernetes, etc. to run a sandbox instance container.

[0074] Secondly, if Figure 5 As shown in the figure, the overall system architecture of the data security sandbox system includes a six-layer model of business scenarios, application market, data assets, sandbox instances, operating environment, and system deployment, as well as global security control.

[0075] The application scenarios describe the application scenarios of the data security sandbox system in the industry of the example, including data open services, data exploration research, multi-party joint modeling, medical scientific research analysis, financial joint risk control, e-commerce precise advertising recommendation and other application scenarios.

[0076] Specific examples are as follows. In the medical research industry, the data security sandbox system can put the clinical medical data and SPSS analysis software of a class of professional diseases into an image based on the Linux operating system, and create a container instance through a container engine such as Docker. In this way, a data security sandbox running instance is created, and then the data security sandbox management system is provided to hospitals and drug development units to access the sandbox instance through a Web browser. In this instance, clinical data analysis can be performed, and the analyzed data can guide the study of disease mechanisms and diagnosis and treatment decisions.

[0077] The application market refers to the application management function of the data security sandbox system. Through the application market, different applications can be combined and placed in the data security sandbox system to adapt to different business scenarios and different user habits. The overall classification of applications includes data analysis applications and AI modeling applications. Among them, data analysis applications include professional applications such as SPSS, SAS, and DataWand. At the same time, programming languages ​​such as Python and R are provided, as well as analysis libraries such as Matplotlib, Pandas, and Scipy supported by these programming languages. AI applications can support processing tools such as machine learning, deep learning, and neural networks, as well as components commonly used in AI modeling such as TensorFlow, Pytorch, and Sklearn.

[0078] A sandbox instance refers to an executable instance of a data sandbox, which supports RDP protocol, VNC protocol, SSH protocol, TELNET protocol, K8S protocol, and Jupyter protocol. Sandbox instances can run on Linux and Windows platforms. A sandbox instance is a container instance created by a container engine such as Docker. The added application software is installed in the container instance. The input directory of the sandbox instance is set by mounting a read-only data directory with the host machine, and the output directory of the sandbox instance is set by mounting a normal directory with the host machine. The sandbox instance can access the added application and data files in the input directory in the sandbox instance interface through a web browser. Use the provided applications and data to perform related business operations, such as data research analysis, AI model training, etc. Finally, the data files produced by the sandbox instance can be stored in the output directory, and the produced data files can be downloaded by reading the output directory of the host machine through the data security sandbox system;

[0079] The operating environment is the operating environment that the security sandbox instance can support. It mainly runs in a container environment, including Docker container environment, Podman container environment, Kubernetes environment, etc., but is not limited to the above operating environments. For example, it can also run directly in a virtual machine, server, and other environments;

[0080] System deployment refers to the environment in which data security sandbox resources are deployed. In order to adapt to the usage scenarios and system deployment requirements of different users, the data security sandbox system supports flexible deployment in different environments such as public cloud, private cloud and hybrid cloud. The data security sandbox system supports cloud-native architecture, architecture using microservices, and can be packaged as container images. The system deployment image can be uploaded to public cloud, private cloud and hybrid cloud environments offline or online. Container deployment tools such as Docker Compose or Kubernetes are used to automatically complete the rapid deployment of the data security sandbox system in the target environment. Docker Compose is suitable for small-scale deployment, while Kubernetes is more suitable for large-scale enterprise-level deployment.

[0081] Security control describes the security control functions of the data security sandbox before, during, and after the event. Sandbox pre-security control prevents unauthorized access by setting sandbox instance access rights and policy management. At the same time, it uses containerized deployment of independent computing environments for each sandbox instance to achieve network isolation, data isolation, and identity isolation. In-process security monitoring can interrupt the sandbox connection session at any time through sandbox connection session management. In addition, the sandbox is connected through the Guacamole service to enable the operation recording function of the sandbox instance, and abnormal login and operation behavior are monitored in real time. Post-security auditing analyzes the operation log to find illegal operations and abnormal behaviors, and checks the operation video playback stored in the sandbox connection session for security auditing.

[0082] The data security sandbox system that supports multiple protocols and multiple scenarios has the following advantages and effects:

[0083] Improve data security and network defense capabilities: By comprehensively analyzing data from multiple protocols, identify and prevent various threat behaviors, and improve data security and network defense capabilities.

[0084] Support multiple protocols and multiple scenarios: It can support multiple protocols and scenarios such as data sharing, data analysis and data mining in different industries and businesses to meet the needs of different users.

[0085] Reduce the false positive rate: Through technologies such as data isolation and behavioral analysis, reduce the possibility of misjudging normal data as threat data, and improve the accuracy and reliability of the system.

[0086] Improve data processing efficiency: Improve data processing efficiency and system performance by optimizing algorithms and system design, ensuring data security without affecting the efficiency of business operations.

[0087] Easy to manage and maintain: The data security sandbox system can adopt automated management tools, which is easy to manage and maintain, reducing manual intervention and operational risks.

[0088] High reliability: The data security sandbox system adopts multi-level security and backup mechanisms to ensure the reliability and integrity of data.

[0089] Good cost-effectiveness: The data security sandbox system can improve data processing efficiency and performance and reduce operating and maintenance costs while ensuring data security.

[0090] The method of supporting multi-protocol and multi-scenario data security sandbox has the advantages and effects of improving data security and network defense capabilities, supporting multi-protocol and multi-scenario, reducing the misjudgment rate, improving data processing efficiency and system performance, easy management and maintenance, high reliability, and good cost-effectiveness. It can provide users with safer and more efficient data processing services, ensure data security, and has broad application prospects and market potential.

[0091] Embodiment 3

[0092] Figure 6 FIG. 2 shows a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 6 As shown, the electronic device includes: a memory 100 and a processor 200, wherein the memory 100 stores a computer program that can be run on the processor 200. When the processor 200 executes the computer program, the secure data processing method in the above embodiment is implemented. The number of the memory 100 and the processor 200 can be one or more.

[0093] The electronic device also includes:

[0094] The communication interface 300 is used to communicate with external devices and perform data exchange transmission.

[0095] If the memory 100, the processor 200 and the communication interface 300 are implemented independently, the memory 100, the processor 200 and the communication interface 300 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0096] Optionally, in a specific implementation, if the memory 100, the processor 200 and the communication interface 300 are integrated on a chip, the memory 100, the processor 200 and the communication interface 300 can communicate with each other through an internal interface.

[0097] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present invention when executed by a processor.

[0098] An embodiment of the present invention further provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present invention.

[0099] An embodiment of the present invention also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided by the embodiment of the invention.

[0100] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0101] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0102] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0103] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0104] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0105] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, segment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present invention includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0106] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0107] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0108] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The storage medium may be a read-only memory, a disk or an optical disk, etc.

[0109] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for processing secure data, characterized in that: include: Acquire original data, perform protocol identification on the original data, and access the original data remotely or in web form according to the protocol identification result; Running a sandbox instance, performing relevant business operations on the original data through a target application, and implementing data isolation through the sandbox instance; wherein the target application includes a business scenario application supporting AI modeling, and a data analysis application; Based on the preset security policy, the operation of the sandbox instance is recorded and monitored in real time. Under the premise of ensuring data security, the data files obtained by the sandbox instance executing the business operation are stored in the specified data output directory for output.

2. The method for processing secure data according to claim 1, characterized in that: The performing protocol identification on the original data includes: Determining whether the original data is a remote connection protocol or an online interactive protocol; The remote connection protocols include RDP protocol, VNC protocol, SSH protocol, TELNET protocol and K8S protocol; The online interactive protocol includes a Jupyter protocol.

3. The method for processing secure data according to claim 1, characterized in that: The method for accessing the original data in remote or web form according to the protocol identification result is: If the original data is a remote connection protocol, remote access and control are performed through Guacamole Server; If the original data is an online interactive protocol, it can be directly opened and run in the form of a WEB page.

4. The method for processing secure data according to claim 1, characterized in that: The method for creating the sandbox instance is: Create a container instance and install the pre-selected target application, and perform related business operations through the target application; allocate independent input and output data directories to each sandbox instance, and configure data volumes or storage for each sandbox instance to achieve network isolation, data isolation and identity isolation; wherein, the input directory is mounted read-only, and the output directory is mounted in normal read-write mode.

5. The method for processing secure data according to claim 1, characterized in that: When running the sandbox instance, it also includes: Verify access rights of the sandbox instance to check whether the sandbox instance can be accessed; After the access permission is verified, the connection information with the sandbox instance is initialized based on the http protocol, and a check is made as to whether the Guacamole agent is connected to the sandbox instance. If so, the Guacamole Server service is connected, and communication is performed through Guacd and the RDP / VNC protocol; if the communication is performed through an online interactive protocol, the JupyterNotebook service is directly connected.

6. The method for processing secure data according to claim 1, characterized in that: The security policy includes using access IP rule restrictions and sandbox data file permission settings.

7. The method for processing secure data according to claim 1, characterized in that: The real-time recording operation and monitoring also includes: When it is determined that the sandbox instance has abnormal operation behavior when in use, data protection measures are executed, and the data protection measures include disconnecting the session, revoking permissions and issuing an alarm.

8. A data security sandbox system, characterized in that: Execute the security data processing method as described in any one of claims 1 to 7.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the security data processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the security data processing method according to any one of claims 1 to 7 is implemented.

Images