Data protection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data protection method and device, electronic equipment and a storage medium. The method comprises the following steps: executing the following operations for a data access request received each time: analyzing the data access request to obtain user information and identification authentication information; generating user identification information for the user information, and generating authentication identification information for the identification authentication information; performing identity authentication based on the user information; and under the condition that the identity authentication is passed, generating a secret key based on the user identification information and the authentication identification information, and performing encryption processing on the data accessed by the data access request by using the secret key. According to the technical scheme, the dynamic key instead of the unchanged static key is generated, so that when the key is lost, only data accessed by the current data access request can be leaked, data accessed by the subsequent data access request cannot be leaked, the risk of data leakage is reduced to a certain extent, and the data access efficiency is improved. And immeasurable loss caused to the user is effectively avoided.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of data encryption protection, and in particular, to a method, device, electronic device and storage medium for data protection. Background Art

[0002] The data security protection system is designed with the idea of ​​organically combining comprehensive data file security strategies, encryption and decryption technologies with mandatory access control. It implements different security levels of control on various data assets on information media to effectively prevent confidential information leakage and theft. Data protection should be guided by the zero-trust architecture, starting from the three perspectives of assets, intrusion, and risk, to achieve the construction of a data security system covering the entire life cycle of data, including data discovery and classification, data usage security, data flow security, external intrusion security, data storage security, situational awareness and other security capability outputs, to build a comprehensive data security protection system;

[0003] When using existing data encryption protection systems, most of them use static keys to encrypt and protect the data that users want to access. Traditional static key management is difficult to meet dynamic needs in complex environments. When static keys are lost, it is easy to cause large-scale data leakage, causing immeasurable losses to users. Summary of the invention

[0004] In view of this, in order to solve the technical problem that the existing use of static keys to encrypt and protect data leads to large-scale data leakage when the static keys are lost, causing immeasurable losses to users, the embodiments of the present invention provide a data protection method, device, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides a data protection method, the method comprising:

[0006] The following operations are performed for each received data access request: the data access request is parsed to obtain user information and identification authentication information;

[0007] Generating user identification information for the user information, and generating authentication identification information for the identification authentication information;

[0008] Authentication based on user information;

[0009] When the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to encrypt the data accessed by the data access request using the key.

[0010] In a possible implementation, generating a key based on user identification information and authentication identification information includes:

[0011] The user identification information and the authentication identification information are sequentially or randomly combined to generate a key.

[0012] In one possible implementation, the method further includes:

[0013] Obtain the behavior log of the subject corresponding to the data access request;

[0014] Obtain feature values ​​of multiple behavior features from the behavior log;

[0015] Determining a trust score based on characteristic values ​​of multiple behavioral characteristics;

[0016] Determine access rights based on trust scores;

[0017] A decryption key corresponding to the key is generated based on the access authority and the user information, so as to decrypt the encrypted data using the decryption key.

[0018] In a possible implementation, determining the trust score based on the feature values ​​of multiple behavior features includes:

[0019] For each behavior feature, determine the abnormal score of the behavior feature based on the feature value of the behavior feature and the preset normal behavior feature value;

[0020] The trust score is determined based on the preset benchmark score, the abnormal score corresponding to each behavioral feature, and the preset behavioral weight value.

[0021] In a possible implementation, determining the abnormal score of the behavior feature based on the feature value of the behavior feature and a preset normal behavior feature value includes:

[0022] Determine the degree of deviation based on the characteristic value of the behavior characteristic and the preset normal behavior characteristic value;

[0023] The abnormal score corresponding to the deviation degree is queried from the abnormal score query table; wherein the abnormal score query table stores the corresponding relationship between the abnormal score and the deviation degree.

[0024] In a possible implementation, determining access rights according to the trust score includes:

[0025] Determining whether the trust score is within a first preset trust score range;

[0026] If it is determined that the trust score is within the first preset trust score range, the access permission is determined to be the first access permission;

[0027] If it is determined that the trust score is not within the first preset trust score range, determining whether the trust score is within the second preset trust score range;

[0028] If it is determined that the trust score is within a second preset trust score range, the access permission is determined to be the second access permission;

[0029] When it is determined that the trust score is not within the second preset trust score range, the access right is determined to be a third access right; wherein the first access right is higher than the second access right, and the second access right is higher than the third access right.

[0030] In a possible implementation, generating a decryption key corresponding to the key based on the access authority and the user information includes:

[0031] Determine data access content based on user information;

[0032] In the case where the access right is the first access right, determining the first data decryption range based on the first access right and the data access content, and generating a decryption key corresponding to the key according to the first data decryption range; or

[0033] In the case where the access permission is the second access permission, a second data decryption range is determined based on the second access permission and the data access content, and a decryption key corresponding to the key is generated according to the second data decryption range.

[0034] In one possible implementation, the method further includes:

[0035] When it is monitored that the trust score is not within the second preset trust score range, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation of blocking the data access request, a triggering alarm operation of sending an alarm message, and an access isolation operation of isolating the subject of the data access request.

[0036] In a second aspect, an embodiment of the present invention provides a data protection device, the device comprising:

[0037] The parsing and obtaining module is used to perform the following operations for each received data access request: parsing the data access request to obtain user information and identification authentication information;

[0038] An identification information generating module, used to generate user identification information for user information, and to generate authentication identification information for identification authentication information;

[0039] Identity authentication module, used for identity authentication based on user information;

[0040] The key generation module is used to generate a key based on the user identification information and the authentication identification information when the identity authentication is passed, so as to encrypt the data accessed by the data access request using the key.

[0041] In a third aspect, an embodiment of the present invention provides an electronic device, which includes: a processor and a memory, the processor is used to execute a data protection program stored in the memory to implement the above-mentioned data protection method.

[0042] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned data protection method.

[0043] The data protection method, device, electronic device and storage medium provided by the embodiment of the present invention include: performing the following operations for each received data access request: parsing the data access request to obtain user information and identification authentication information; generating user identification information for the user information, and generating authentication identification information for the identification authentication information; performing identity authentication based on the user information; and generating a key based on the user identification information and the authentication identification information when the identity authentication is passed, so as to use the key to encrypt the data accessed by the data access request. The key generation in the above technical scheme is based on the identification information corresponding to the user information and the authentication identification information carried in each data access request sent by the user. It can be understood that the key generated for each data access request is related to the identification information. Therefore, when the identification information generated for each data access request is different, a dynamic key is generated instead of a static key that remains unchanged. Therefore, when the key is lost, only the data accessed by the current data access request can be leaked, and the data accessed by the subsequent data access request cannot be leaked, which reduces the risk of data leakage to a certain extent and effectively avoids causing immeasurable losses to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flow chart of an embodiment of a data protection method provided by an embodiment of the present invention;

[0045] Figure 2 A flowchart of another data protection method provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of an example of trust score calculation data provided by an embodiment of the present invention;

[0047] Figure 4 A block diagram of an embodiment of a data protection device provided by an embodiment of the present invention;

[0048] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0051] An embodiment of the present invention provides a method for data protection, which can be applied to a data encryption protection system guided by a zero-trust architecture. The data encryption protection system is deployed on a server that provides corresponding accessed data for a data access request.

[0052] See also Figure 1 , Figure 1 A flow chart of an embodiment of a data protection method provided in an embodiment of the present invention. Figure 1 The process shown may include the following steps:

[0053] Step 101, for each received data access request, the following operations are performed: the data access request is parsed to obtain user information and identification authentication information;

[0054] User information can be understood as information that can be used to indicate the identity of the user, and identification authentication information can be understood as relevant information indicating this data access, such as device fingerprints, network location, and session information, etc., which are not limited here.

[0055] Step 102, generating user identification information for the user information, and generating authentication identification information for the identification authentication information;

[0056] In order to uniquely identify the above-mentioned user information and identification authentication information, in this embodiment, it is necessary to generate user identification information that needs to indicate the user identity for the user information, so as to distinguish different user identities, such as customer service, operation, logistics, etc.; it is necessary to generate authentication identification information that indicates data access related information for the identification authentication information. If the identification authentication information includes device fingerprint, network location and session information, then the authentication identification information needs to generate device identification information of the device based on the device fingerprint for distinguishing the user's device, generate an environment identifier to distinguish the network location, and generate a unique session identifier corresponding to each data access request.

[0057] In actual application, the above user identification information and identification authentication information can be identified by numbers, English, letters, other characters or any combination of the above, which is not limited here.

[0058] Step 103, identity authentication based on user information;

[0059] When initiating a data access request, the user's identity is authenticated. Specifically, multi-factor identity authentication (such as SMS verification code or device verification) can be performed through user information. This multi-factor identity authentication can fully ensure the authenticity of the user's identity. The specific multi-factor identity authentication process is a prior art method and will not be elaborated here.

[0060] Step 104: if the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to encrypt the data accessed by the data access request using the key.

[0061] When the user identity of the data access request is authentic and correct, a dynamic key can be generated based on the above-mentioned user identification information and authentication identification information. Specifically, the user identification information and the authentication identification information are sequentially or randomly combined to generate the key. If the authentication identification information includes device identification information, environment identification and session identification, in one embodiment, the key can be generated in the order of user identification information, device identification information, environment identification and session identification; for example, the user identification information is 1, the device identification information in the authentication identification information is 2, the environment identification is 3 and the session identification is 4, then the key generated in the order of user identification information, device identification information, environment identification and session identification is 1234.

[0062] In another implementation, the above-mentioned user identification information, device identification information, environment identification and session identification may also be randomly sorted to generate a key, as long as the generated key includes the above-mentioned identification information, such as 1342, 1243, 3214, 4231, etc., which are not listed one by one here.

[0063] In this embodiment, the generated key is used to encrypt the data accessed by the data access request to ensure the privacy and security of the data.

[0064] Through the method in this embodiment, the key is generated based on the identification information corresponding to the user information and authentication identification information carried in each data access request sent by the user. It can be understood that the key generated for each data access request is related to the identification information. Therefore, when the identification information generated for each data access request is different, a dynamic key is generated instead of a static key that remains unchanged. Therefore, when the key is lost, only the data accessed by the current data access request can be leaked, and the data accessed by subsequent data access requests cannot be leaked. This reduces the risk of data leakage to a certain extent and effectively avoids inestimable losses to users.

[0065] exist Figure 1 Based on Figure 2 , Figure 2 A flow chart of another data protection method provided in an embodiment of the present invention. Figure 2 The process shown may include the following steps:

[0066] Step 201, for each received data access request, the following operations are performed: the data access request is parsed to obtain user information and identification authentication information;

[0067] Step 202, generating user identification information for the user information, and generating authentication identification information for the identification authentication information;

[0068] Step 203, identity authentication based on user information;

[0069] Step 204, if the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to encrypt the data accessed by the data access request using the key;

[0070] The process from step 201 to step 204 is the same as Figure 1 The process from step 101 to step 104 is not described in detail here.

[0071] Step 205, obtaining the behavior log of the subject corresponding to the data access request;

[0072] The subject refers to the device, application, etc. that sends the data access request. The server corresponding to the subject usually stores a behavior log for data access to record the characteristic values ​​of various behavioral characteristics of user access to data. The source of the subject can usually be determined through the data access request, and then the behavior log can be obtained from the server of the subject based on the source of the subject.

[0073] Step 206, obtaining characteristic values ​​of multiple behavior characteristics from the behavior log;

[0074] Since there are many behavior features of user access data recorded in the behavior log, in this embodiment, the multiple behavior features obtained from the behavior log must be behavior features related to the trust score determination, and then the feature values ​​of the behavior features are obtained.

[0075] Step 207, determining a trust score based on the characteristic values ​​of the plurality of behavior characteristics;

[0076] The trust score is a quantitative indicator used to assess data access risks. It can be understood that the higher the trust score, the lower the risk of data access by the subject. Conversely, the lower the trust score, the higher the risk of data access by the subject.

[0077] The process of determining the trust score based on the characteristic values ​​of multiple behavioral characteristics can be implemented through steps A1 to A2:

[0078] Step A1, for each behavior feature, determining an abnormal score of the behavior feature based on a feature value of the behavior feature and a preset normal behavior feature value;

[0079] The preset normal behavior feature value is the normal feature value corresponding to the behavior feature of data access without risk of data access. The abnormal score can be understood as a quantitative indicator used to measure the deviation between the behavior feature and the preset normal behavior feature. The abnormal score can be determined based on the deviation between the behavior feature and the preset normal behavior feature. The specific abnormal score determination process is: determine the deviation based on the feature value of the behavior feature and the preset normal behavior feature value; query the abnormal score corresponding to the deviation from the abnormal score query table.

[0080] Among them, the abnormal score query table stores the correspondence between the abnormal score and the degree of deviation. For example, the correspondence between the abnormal score and the degree of deviation stored in the abnormal score query table is such that the abnormal score corresponding to a slight deviation is 5 points, the abnormal score corresponding to a moderate deviation is 10 points, and the abnormal score corresponding to a severe deviation is 20 points. It should be noted that the above-listed correspondence between the abnormal score and the degree of deviation is only an example. The specific correspondence between the abnormal score and the degree of deviation can be set according to actual needs and is not limited here.

[0081] Therefore, after determining the degree of deviation between the behavioral feature and the preset normal behavioral feature, the abnormal score of each behavioral feature can be accurately determined by looking up a table for use in the subsequent calculation of the trust score.

[0082] Step A2: determining a trust score based on a preset benchmark score, an abnormal score corresponding to each behavior feature, and a preset behavior weight value.

[0083] The specific trust score can be calculated by the following formula: Among them, z represents the trust score, a represents the benchmark score, and bi represents the preset behavior weight value corresponding to the ith behavior feature, c i Represents the abnormal score corresponding to the i-th behavioral feature.

[0084] The preset behavior weight values ​​corresponding to the above-mentioned each behavior feature are pre-set according to the degree of influence of the behavior feature on data access security, wherein the larger the preset behavior weight value, the higher the degree of influence of the behavior feature on data access security, and conversely, the smaller the preset behavior weight value, the lower the degree of influence of the behavior feature on data access security.

[0085] In order to facilitate the understanding of the calculation process of the above trust score, Figure 3 An example of trust score calculation data is shown in FIG. Figure 3 As shown in the figure, the characteristic values, preset normal behavior characteristic values, abnormal scores and preset behavior weight values ​​corresponding to the six behavior characteristics of access frequency, access mode, data sensitivity, access location, access time and device characteristics are given. In actual application, if the preset benchmark score is set to 100, then according to Figure 3 The calculated trust score for the data example shown in is: z=100-(0.3*10+0.2*20+0.25*20+0.15*15+0.05*10+0.05*5)=85.

[0086] Step 208, determining access rights according to the trust score;

[0087] In actual application, different trust scores correspond to different access rights. The access right is the user's right to access data. The specific process of determining the access right according to the trust score is: determining whether the trust score is within a first preset trust score range; if the trust score is determined to be within the first preset trust score range, the access right is determined to be the first access right; if the trust score is determined not to be within the first preset trust score range, determining whether the trust score is within a second preset trust score range; if the trust score is determined to be within the second preset trust score range, the access right is determined to be the second access right; if the trust score is determined not to be within the second preset trust score range, the access right is determined to be the third access right;

[0088] The first access right is higher than the second access right, and the second access right is higher than the third access right. The first access right is full trust, the right for normal data access, the second access right is partial trust, the right for limited access to sensitive data, and the third access right is not allowed to access data.

[0089] It can be seen from this that since the first access permission is higher than the second access permission, the value of the first preset trust score range must be greater than the value of the second preset trust score range. For example, the first preset trust score range is [80, 100], and the second preset trust score range is [60, 80). The specific first preset trust score range and the second preset trust score range can be set according to actual needs and are not limited here.

[0090] In specific implementation, the access rights can be dynamically adjusted according to the trust score. If the user's current access right is the first access right, but the user frequently queries multiple user orders or checks payment information in a short period of time, the trust score will be reduced, and the user's current access right will need to be adjusted from the first access right to the second access right or the third access right.

[0091] If it is monitored that the trust score is not within the second preset trust score range, that is, the access permission is the third access permission, an abnormal response operation is generated to promptly discover and respond to abnormal data access.

[0092] Among them, the abnormal response operation at least includes: a blocking operation of blocking the data access request, a triggering alarm operation of sending an alarm message, and an access isolation operation of isolating the subject of the data access request. The blocking operation is to directly reject the data access request, the triggering alarm operation is to send an alarm message to the security personnel to prompt the security personnel to take corresponding measures to deal with abnormal data access, and the access isolation operation is to isolate the abnormal subject for further behavior review. Data security can be maintained in a timely manner through real-time blocking and response to abnormal data access.

[0093] Step 209: Generate a decryption key corresponding to the key based on the access authority and the user information, so as to decrypt the encrypted data using the decryption key.

[0094] The generation process of the decryption key can be implemented through steps B1 to B3:

[0095] Step B1, determining data access content based on user information;

[0096] It can be understood that the data content that users corresponding to different user information can access is different. For example, if the user information indicates that the user is a customer service staff, then he can only view the user's basic information and order status, but cannot view the user's payment information; if it is an operation staff, he can view the membership level and consumption records, but the user's specific order details are blocked; if it is a logistics staff, he is only allowed to access the delivery address and mobile phone number, and the payment and consumption records are not displayed; if it is a financial staff, he can only view the payment information and order amount, and other information cannot be viewed.

[0097] Step B2, when the access permission is the first access permission, determining the first data decryption range based on the first access permission and the data access content, and generating a decryption key corresponding to the key according to the first data decryption range;

[0098] Since the first access right is the normal data access right, it can support users to access all data access contents under their authority. Therefore, the first data decryption range is the data access contents that users can access and view. Therefore, it is necessary to generate a decryption key for the data access contents, i.e., the first data decryption range, to decrypt the key-encrypted data for data viewing. The data not in the first data decryption range is displayed in a masked form after decryption. For example, the user data access content only has the first three digits and the last four digits of the mobile phone number. Then, the data displayed after the decryption operation is "138****5678".

[0099] Step B3: when the access right is the second access right, determine the second data decryption range based on the second access right and the data access content, and generate a decryption key corresponding to the key according to the second data decryption range.

[0100] Since the second access right is to prevent access to sensitive data and can support users to access part of the data access content within their authority, the second data decryption range is part of the data access content. Therefore, it is necessary to generate a decryption key for this part of the data access content, i.e., the second data decryption range, to decrypt the key-encrypted data for data viewing, and the data not in the second data decryption range is displayed in a masked form after decryption. For example, the user data access content includes mobile phone number and user name, and the second access right is to only access the user name. Then the data displayed after the decryption operation is "***********, Li Si".

[0101] Since the third access right does not have the right to access data, there is no need to generate a decryption key for the user to decrypt the encrypted data.

[0102] In actual application, in order to facilitate subsequent tracking and analysis, data access requests, identity authentication, key generation, behavior monitoring results and abnormal response operations can be recorded in the log of the data encryption protection system. That is, the log records the detailed operation steps and results of data access, and generates a security audit report based on the log content to facilitate subsequent audits and security inspections.

[0103] See also Figure 4 , is a block diagram of an embodiment of a data protection device provided by an embodiment of the present invention. Figure 4 As shown, the device comprises:

[0104] The parsing and obtaining module 401 is used to perform the following operations for each received data access request: parsing the data access request to obtain user information and identification authentication information;

[0105] The identification information generating module 402 is used to generate user identification information for user information and to generate authentication identification information for identification authentication information;

[0106] Identity authentication module 403, used for identity authentication based on user information;

[0107] The key generation module 404 is used to generate a key based on the user identification information and the authentication identification information when the identity authentication is passed, so as to encrypt the data accessed by the data access request using the key.

[0108] In the data protection device provided by the embodiment of the present invention, the key is generated based on the identification information corresponding to the user information and authentication identification information carried in each data access request sent by the user. It can be understood that the key generated for each data access request is related to the identification information. Therefore, when the identification information generated for each data access request is different, a dynamic key is generated instead of a static key that remains unchanged. Therefore, when the key is lost, only the data accessed by the current data access request can be leaked, and the data accessed by subsequent data access requests cannot be leaked. This reduces the risk of data leakage to a certain extent and effectively avoids inestimable losses to users.

[0109] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 5 The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 5 Various buses are labeled as bus system 1205.

[0110] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0111] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0112] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .

[0113] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.

[0114] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment, for example, including:

[0115] The following operations are performed for each received data access request: the data access request is parsed to obtain user information and identification authentication information;

[0116] Generating user identification information for the user information, and generating authentication identification information for the identification authentication information;

[0117] Authentication based on user information;

[0118] When the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to encrypt the data accessed by the data access request using the key.

[0119] In a possible implementation, generating a key based on user identification information and authentication identification information includes:

[0120] The user identification information and the authentication identification information are sequentially or randomly combined to generate a key.

[0121] In one possible implementation, the method further includes:

[0122] Obtain the behavior log of the subject corresponding to the data access request;

[0123] Obtain feature values ​​of multiple behavior features from the behavior log;

[0124] Determining a trust score based on characteristic values ​​of multiple behavioral characteristics;

[0125] Determine access rights based on trust scores;

[0126] A decryption key corresponding to the key is generated based on the access authority and the user information, so as to decrypt the encrypted data using the decryption key.

[0127] In a possible implementation, determining the trust score based on the feature values ​​of multiple behavior features includes:

[0128] For each behavior feature, determine the abnormal score of the behavior feature based on the feature value of the behavior feature and the preset normal behavior feature value;

[0129] The trust score is determined based on the preset benchmark score, the abnormal score corresponding to each behavioral feature, and the preset behavioral weight value.

[0130] In a possible implementation, determining the abnormal score of the behavior feature based on the feature value of the behavior feature and a preset normal behavior feature value includes:

[0131] Determine the degree of deviation based on the characteristic value of the behavior characteristic and the preset normal behavior characteristic value;

[0132] The abnormal score corresponding to the deviation degree is queried from the abnormal score query table; wherein the abnormal score query table stores the corresponding relationship between the abnormal score and the deviation degree.

[0133] In a possible implementation, determining access rights according to the trust score includes:

[0134] Determining whether the trust score is within a first preset trust score range;

[0135] If it is determined that the trust score is within the first preset trust score range, the access permission is determined to be the first access permission;

[0136] If it is determined that the trust score is not within the first preset trust score range, determining whether the trust score is within the second preset trust score range;

[0137] If it is determined that the trust score is within a second preset trust score range, the access permission is determined to be the second access permission;

[0138] When it is determined that the trust score is not within the second preset trust score range, the access right is determined to be a third access right; wherein the first access right is higher than the second access right, and the second access right is higher than the third access right.

[0139] In a possible implementation, generating a decryption key corresponding to the key based on the access authority and the user information includes:

[0140] Determine data access content based on user information;

[0141] In the case where the access right is the first access right, determining the first data decryption range based on the first access right and the data access content, and generating a decryption key corresponding to the key according to the first data decryption range; or

[0142] In the case where the access permission is the second access permission, a second data decryption range is determined based on the second access permission and the data access content, and a decryption key corresponding to the key is generated according to the second data decryption range.

[0143] In one possible implementation, the method further includes:

[0144] When it is monitored that the trust score is not within the second preset trust score range, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation of blocking the data access request, a triggering alarm operation of sending an alarm message, and an access isolation operation of isolating the subject of the data access request.

[0145] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.

[0146] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0147] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0148] The electronic device provided in this embodiment may be Figure 5 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-2 All steps of the data protection method are achieved Figure 1-2 For details on the technical effects of the data protection method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0149] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0150] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned data protection method can be implemented.

[0151] The processor is used to execute the data protection program stored in the memory to implement the steps of the following data protection method:

[0152] The following operations are performed for each received data access request: the data access request is parsed to obtain user information and identification authentication information;

[0153] Generating user identification information for the user information, and generating authentication identification information for the identification authentication information;

[0154] Authentication based on user information;

[0155] When the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to encrypt the data accessed by the data access request using the key.

[0156] In a possible implementation, generating a key based on user identification information and authentication identification information includes:

[0157] The user identification information and the authentication identification information are sequentially or randomly combined to generate a key.

[0158] In one possible implementation, the method further includes:

[0159] Obtain the behavior log of the subject corresponding to the data access request;

[0160] Obtain feature values ​​of multiple behavior features from the behavior log;

[0161] Determining a trust score based on characteristic values ​​of multiple behavioral characteristics;

[0162] Determine access rights based on trust scores;

[0163] A decryption key corresponding to the key is generated based on the access authority and the user information, so as to decrypt the encrypted data using the decryption key.

[0164] In a possible implementation, determining the trust score based on the feature values ​​of multiple behavior features includes:

[0165] For each behavior feature, determine the abnormal score of the behavior feature based on the feature value of the behavior feature and the preset normal behavior feature value;

[0166] The trust score is determined based on the preset benchmark score, the abnormal score corresponding to each behavioral feature, and the preset behavioral weight value.

[0167] In a possible implementation, determining the abnormal score of the behavior feature based on the feature value of the behavior feature and a preset normal behavior feature value includes:

[0168] Determine the degree of deviation based on the characteristic value of the behavior characteristic and the preset normal behavior characteristic value;

[0169] The abnormal score corresponding to the deviation degree is queried from the abnormal score query table; wherein the abnormal score query table stores the corresponding relationship between the abnormal score and the deviation degree.

[0170] In a possible implementation, determining access rights according to the trust score includes:

[0171] Determining whether the trust score is within a first preset trust score range;

[0172] If it is determined that the trust score is within the first preset trust score range, the access permission is determined to be the first access permission;

[0173] If it is determined that the trust score is not within the first preset trust score range, determining whether the trust score is within the second preset trust score range;

[0174] If it is determined that the trust score is within a second preset trust score range, the access permission is determined to be the second access permission;

[0175] When it is determined that the trust score is not within the second preset trust score range, the access right is determined to be a third access right; wherein the first access right is higher than the second access right, and the second access right is higher than the third access right.

[0176] In a possible implementation, generating a decryption key corresponding to the key based on the access authority and the user information includes:

[0177] Determine data access content based on user information;

[0178] In the case where the access right is the first access right, determining the first data decryption range based on the first access right and the data access content, and generating a decryption key corresponding to the key according to the first data decryption range; or

[0179] In the case where the access permission is the second access permission, a second data decryption range is determined based on the second access permission and the data access content, and a decryption key corresponding to the key is generated according to the second data decryption range.

[0180] In one possible implementation, the method further includes:

[0181] When it is monitored that the trust score is not within the second preset trust score range, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation of blocking the data access request, a triggering alarm operation of sending an alarm message, and an access isolation operation of isolating the subject of the data access request.

[0182] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0183] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0184] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data protection method, characterized in that: The method comprises: The following operations are performed for each received data access request: parsing the data access request to obtain user information and identification authentication information; Generating user identification information for the user information, and generating authentication identification information for the identification authentication information; Performing identity authentication based on the user information; In the case where the identity authentication is passed, a key is generated based on the user identification information and the authentication identification information, so as to use the key to encrypt the data accessed by the data access request.

2. The method according to claim 1, characterized in that The generating a key based on the user identification information and the authentication identification information comprises: The user identification information and the authentication identification information are sequentially or randomly combined to generate a key.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining a behavior log of a subject corresponding to the data access request; Acquire feature values ​​of multiple behavior features from the behavior log; Determining a trust score based on the characteristic values ​​of the plurality of behavioral characteristics; Determining access rights based on the trust score; A decryption key corresponding to the key is generated based on the access authority and the user information, so as to decrypt the encrypted data using the decryption key.

4. The method according to claim 3, characterized in that The determining of the trust score based on the feature values ​​of the plurality of behavior features comprises: For each of the behavior features, determining an abnormality score of the behavior feature based on a feature value of the behavior feature and a preset normal behavior feature value; The trust score is determined according to a preset benchmark score, an abnormal score corresponding to each of the behavioral features, and a preset behavioral weight value.

5. The method according to claim 4, characterized in that The determining the abnormal score of the behavior feature based on the feature value of the behavior feature and a preset normal behavior feature value includes: Determining a degree of deviation based on a characteristic value of the behavior characteristic and a preset normal behavior characteristic value; The abnormal score corresponding to the deviation degree is queried from the abnormal score query table; wherein the abnormal score query table stores the corresponding relationship between the abnormal score and the deviation degree.

6. The method according to claim 3, characterized in that The determining the access permission according to the trust score includes: Determining whether the trust score is within a first preset trust score range; In the case where it is determined that the trust score is within the first preset trust score range, the access permission is determined to be the first access permission; If it is determined that the trust score is not within the first preset trust score range, determining whether the trust score is within a second preset trust score range; In the case where it is determined that the trust score is within the second preset trust score range, the access permission is determined to be the second access permission; When it is determined that the trust score is not within the second preset trust score range, the access right is determined to be a third access right; wherein the first access right is higher than the second access right, and the second access right is higher than the third access right.

7. The method according to claim 6, characterized in that The generating a decryption key corresponding to the key based on the access authority and the user information includes: Determine data access content based on the user information; In the case where the access right is the first access right, determining a first data decryption range based on the first access right and the data access content, and generating a decryption key corresponding to the key according to the first data decryption range; or In a case where the access permission is the second access permission, a second data decryption range is determined based on the second access permission and the data access content, and a decryption key corresponding to the key is generated according to the second data decryption range.

8. The method according to claim 6, characterized in that The method further comprises: When it is monitored that the trust score is not within the second preset trust score range, an exception response operation is generated; wherein the exception response operation at least includes: a blocking operation of blocking the data access request, a triggering alarm operation of sending an alarm message, and an access isolation operation of isolating the subject of the data access request.

9. A data protection device, characterized in that: The device comprises: The parsing and obtaining module is used to perform the following operations for each received data access request: parsing the data access request to obtain user information and identification authentication information; An identification information generating module, used to generate user identification information for the user information, and to generate authentication identification information for the identification authentication information; An identity authentication module, used for performing identity authentication based on the user information; The key generation module is used to generate a key based on the user identification information and the authentication identification information when the identity authentication is passed, so as to use the key to encrypt the data accessed by the data access request.

10. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a data protection program stored in the memory to implement the data protection method according to any one of claims 1 to 8.

11. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data protection method according to any one of claims 1 to 8.

Images