Data auditing method and device based on confidential environment

Abstract

The invention belongs to the technical field of computers, and particularly relates to a data auditing method and device based on a confidential environment. The method comprises the following steps: acquiring operation of a terminal user in a confidential environment through a file system probe to obtain to-be-processed data; monitoring the to-be-processed data through a database storage probe, and reporting the monitored and changed data; and mining and analyzing the data reported by the database storage probe through an Apache probe, and auditing the operation of the terminal user. According to the method, user operation and data auditing in a confidential environment are completed through a method of monitoring data in a full life cycle of an electronic file and incrementally transmitting user operation data between a special client and a special server, and the method is generally used for an electronic security level mark management system of an existing security product. And rapid retrieval and statistics of information such as user data, file distribution, violation alarm, user operation, terminal information and operation ranking can be realized at the minimum cost.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a data auditing method and device based on a confidentiality environment. Background Art

[0002] Electronic files refer to data files generated in computers and application systems, including documents, pictures, sounds, videos, etc. The confidentiality mark indicates the confidentiality of the information carried by the marked object. Confidentiality marking technology is a security protection technology that marks the confidentiality of any electronic file in a confidential environment, including documents, pictures, sounds, videos, etc., to achieve the binding of confidentiality marks with electronic files, and provide management functions such as electronic file confidentiality marking, confidentiality determination, confidentiality mark change, confidentiality mark removal, confidentiality file access control and usage audit, and provide explicit confidentiality marks and implicit confidentiality marks for electronic files.

[0003] According to the requirements of graded protection, electronic files in confidential environments should be protected by confidentiality marking technology, and electronic files stored and transmitted must be marked with confidentiality marks. Therefore, the electronic confidentiality mark management system has become one of the standard security products in confidential environments.

[0004] The general electronic confidentiality level marking management system can record in detail the user's operations on classified files, including the operator, operation time, operation IP address, operation object, operation behavior, operation results, etc. Although data statistical analysis can be performed, human review is still required. Summary of the invention

[0005] The purpose of this application is to provide a data audit method and device based on a confidential environment to solve the problem that although the existing electronic confidentiality level mark management system for security products can perform data statistical analysis, it still requires human review.

[0006] Technical solution to achieve the purpose of this application:

[0007] A first aspect of an embodiment of the present application provides a data audit method based on a confidentiality environment, the method comprising:

[0008] The file system probe is used to obtain the operations of the terminal users in the confidential environment and obtain the data to be processed;

[0009] Monitor the data to be processed through database storage probes and report the monitored data changes;

[0010] The data reported by the database storage probe is mined and analyzed through the Apache probe, and the operation of the terminal user is audited.

[0011] Optionally, acquiring the operation of the terminal user in the confidential environment by using the file system probe to obtain the data to be processed specifically includes:

[0012] The file system probe monitors the creation, modification and deletion events of the operation files in real time to obtain the data to be processed;

[0013] The data to be processed is reported via the WebSocket protocol.

[0014] Optionally, monitoring the data to be processed by using a database storage probe and reporting the monitored changed data specifically includes:

[0015] Use database listeners to monitor document data, user data, and department data, and use incremental transmission to report the monitored data changes through the WebSocket protocol;

[0016] Optionally, the mining and analyzing of the data reported by the database storage probe by using the Apache probe and auditing the operation of the terminal user specifically includes:

[0017] The data reported by the database storage probe is preliminarily screened and classified for storage, and FastJson is used to mine and analyze user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of annotations, and number of secret codes.

[0018] Optionally, the method further includes mining and analyzing the data reported by the database storage probe through an Apache probe and auditing the operation of the terminal user, and then:

[0019] After data collection and analysis, audit information is counted and displayed; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

[0020] Optionally, the data collection and analysis to present the audit information may further include:

[0021] Based on the audit information, an early warning is issued if the user's confidentiality level does not match the corresponding confidentiality level ciphertext storage quantity or if a user violates the regulations.

[0022] A second aspect of an embodiment of the present application provides a data auditing device based on a confidentiality environment, the device comprising:

[0023] A data acquisition module is used to acquire the operations of the terminal user in the confidential environment through the file system probe to obtain the data to be processed;

[0024] The data reporting module is used to monitor the data to be processed through the database storage probe and report the monitored changed data;

[0025] The data audit module is used to mine and analyze the data reported by the database storage probe through the Apache probe and to audit the operations of the terminal users.

[0026] Optionally, the device further includes:

[0027] The statistical analysis module is used to collect and analyze data, count and display audit information; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

[0028] A third aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed, any one of the data auditing methods based on a confidential environment provided in the first aspect of the embodiment of the present application is implemented.

[0029] The fourth aspect of an embodiment of the present application provides a terminal, including a memory and a processor; a computer program is stored in the memory, and when the processor runs the computer program, any one of the data auditing methods based on a confidential environment provided in the first aspect of the embodiment of the present application is implemented.

[0030] The beneficial technical effects of this application are:

[0031] The embodiment of the present application provides a data auditing method and device based on a confidential environment, the method comprising: obtaining the operations of terminal users in a confidential environment through a file system probe to obtain data to be processed; monitoring the data to be processed through a database storage probe and reporting the monitored data changes; mining and analyzing the data reported by the database storage probe through an Apache probe to audit the operations of the terminal users. The method completes the audit of user operations and data in a confidential environment by monitoring data throughout the life cycle of electronic files and incrementally transmitting user operation data between a dedicated client and a dedicated server. It is commonly used in existing electronic confidentiality mark management systems for security products, and can achieve rapid retrieval and statistics of information such as user data, file distribution, violation alarms, user operations, terminal information, and operation rankings at minimal cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a data audit method based on a confidential environment is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make those skilled in the art better understand the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described below are only a part of the embodiments of the present application, not all. Based on the embodiments recorded in the present application, all other embodiments obtained by those skilled in the art without paying creative work are within the scope of protection of the present application.

[0034] The inventor of this application found in his research that in order to improve the ability of active defense, the electronic confidentiality mark management system should be able to actively collect operation information and issue early warnings in massive data. In view of the above situation, it is necessary to develop a new data probe device, which is also adapted to the electronic confidentiality mark management system for security products in a confidential environment, so as to realize the rapid retrieval and statistics of user data, file distribution, violation alarms, user operations, terminal information, operation rankings and other information at the lowest cost.

[0035] In order to solve the problem that the existing electronic classification mark management system for security products cannot actively collect operation information and issue early warnings in massive data, the embodiment of the present application provides a data audit method and device based on a confidential environment. With the help of information technology, a set of data probes consisting of file system probes, database storage probes, and Apache probes are designed. Through the method of monitoring data throughout the life cycle of electronic files and incremental transmission of user operation data between a dedicated client and a dedicated server, the audit of user operations and data in a confidential environment is completed. The embodiment of the present application is generally applicable to the existing electronic classification mark management system for security products, and can realize rapid retrieval and statistics of information such as user data, file distribution, violation alarms, user operations, terminal information, and operation rankings at the lowest cost.

[0036] Based on the above content, in order to clearly and in detail illustrate the above advantages of the present application, the specific implementation methods of the present application will be described below in conjunction with the accompanying drawings.

[0037] See also Figure 1 , which is a flow chart of a data auditing method based on a confidential environment provided in an embodiment of the present application.

[0038] The present application provides a data audit method based on a confidentiality environment, including:

[0039] Step S101: obtaining the operation of the terminal user in the confidential environment through the file system probe to obtain the data to be processed;

[0040] Step S102: Monitor the data to be processed through the database storage probe, and report the monitored changed data;

[0041] Step S103: mining and analyzing the data reported by the database storage probe through the Apache probe, and auditing the operations of the terminal user.

[0042] It is understandable that data auditing in a confidential environment needs to be combined with an electronic file classification marking system to meet security and confidentiality requirements. Secondly, user data, user terminal information, file operations and other information are stored in hierarchical and domain-specific encrypted form, and the data acquisition process is more difficult than in an ordinary environment. Since data storage probes require specific hardware support or drivers, file system probes and Apache probes need to work properly in the corresponding operating system and network environment, the three probes are independent of each other, so that the method can adjust the relevant parameter settings according to the actual usage scenario to meet different needs. The data storage probe is the foundation, providing data storage efficiency, and the file system probe is a bridge to ensure the effective collection of data; the Apache probe provides services based on massive data and realizes information interaction and release through Web services.

[0043] The file system probe is to extract and analyze the data information of the file management client, and use the client interface to detect the specified format files in the system, and analyze and transmit the file structure information according to the rule set. The data storage probe is mainly responsible for connecting with the database, and preliminarily screening and classifying the data collected and transmitted by the file system probe. After the storage is completed, the Apache probe will normalize the massive data, perform secondary screening and cleaning, and classify and identify the data resources to realize the value of data reuse.

[0044] In some possible implementations of the embodiments of the present application, step S101 may specifically include:

[0045] The file system probe monitors the creation, modification and deletion events of the operation files in real time to obtain the data to be processed;

[0046] The data to be processed is reported via the WebSocket protocol.

[0047] In one example, the information collected by the file system probe includes file operation information and user terminal information, wherein the file operation information includes information such as pre-confidentiality, confidentiality, reading, copying, and printing operations of different file confidentiality levels on the user terminal, and the user terminal information includes information such as host name, MAC, machine code, IP address, terminal confidentiality level, etc. The file system probe controls user request permissions through security control and uses log technology to perform log formatting and collection in an incremental manner. The file system probe obtains user and file operation information; the first step is to determine whether the document is a confidential file, the second step is to determine the confidentiality level of the user's operation document (public, internal, secret, confidential, top secret), and the third step is to record user operation information (unique identification of the operation document, document name, operation type, operation time, etc.), and the operation types are divided into reading, copying, editing, printing, screenshot, decryption, encryption, save as, renaming, deleting, adding tags, modifying tags, deleting tags, etc.

[0048] In some possible implementations of the embodiments of the present application, step S102 may specifically include:

[0049] Use database listeners to monitor document data, user data, and department data, and use incremental transmission to report the monitored data changes through the WebSocket protocol;

[0050] It is understandable that the data storage probe uses the database listener to monitor the information collected by the file system probe. The data storage probe transfers the above-mentioned information and user terminal information (such as host name, MAC, machine code, IP address, terminal classification) to the electronic file classification marking system database.

[0051] In some possible implementations of the embodiments of the present application, step S103 may specifically include:

[0052] The data reported by the database storage probe is preliminarily screened and classified for storage, and FastJson is used to mine and analyze user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of annotations, and number of secret codes.

[0053] In one example, the Apache probe packages data into JSON format as a standard format for data storage and transmission, and then uses WebSocket and Http protocols for data exchange and transmission. The Apache probe combines strategies and database information for mining and analysis, and uses the data retrieval engine to retrieve and count user data, file distribution, violation alerts, user operations, terminal information, and operation rankings based on multi-dimensional retrieval conditions, and writes the analyzed data back to the database; the front-end user interface displays the query status.

[0054] In actual applications, dedicated servers are used to run data storage probes and Apache probes, and collect data collected by database storage probes, Apache probes, and file system probes, and perform statistical analysis; dedicated clients are used to run file system probes. Dedicated clients work with dedicated servers to issue security policies, control user operation permissions, record user operation behaviors in real time, and form complete audit logs. Standard interfaces are used to ensure the versatility of data probe programs and serve as adapters and bridges for adapting to other systems. This standard interface is designed from three aspects: file system probes, database storage probes, and Apache probes, and provides interface health check functions, database configuration, interface address configuration, and other functions.

[0055] For file system probes, standard interface requirements are provided, including various types of received fields and field types, to ensure the accuracy of data collected by file system probes and improve audit accuracy; for database storage probes, it supports the docking of MySQL database and DAMO database, and ensures the accuracy and completeness of collected data through data feature splitting and extraction of binlog logs and redo logs; for Apache probes, a data verification interface is provided to ensure that data collected by file system probes and database storage probes can be correctly identified and processed by Apache probes.

[0056] In some possible implementations of the embodiment of the present application, step S103 may further include:

[0057] After data collection and analysis, audit information is counted and displayed; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

[0058] In the specific implementation, the collected data is recorded in the statistical table and detailed information table respectively, and statistics are generated according to user operations. After data collection and analysis, information including data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of secret codes is displayed, and the data retrieval engine is used to retrieve and count user data, file distribution, violation alarms, user operations, terminal information and operation rankings according to multi-dimensional retrieval conditions.

[0059] In one example, the data collection and analysis to present audit information may also include:

[0060] Based on the audit information, an early warning is issued if the user's confidentiality level does not match the corresponding confidentiality level ciphertext storage quantity or if a user violates the regulations.

[0061] In a specific example, when a dedicated client logs in, online / offline logins and illegal logins are distinguished. Offline login logs will be temporarily stored locally on the dedicated machine and transmitted back after a connection is established with the dedicated server; online login file system probes will temporarily store user information (such as login name, certificate serial number, user account, user confidentiality level, ID number, department name, and confidentiality authority);

[0062] The file system probe obtains the operation information of users and files; the first step is to determine whether the document is a classified file, the second step is to determine the confidentiality level of the user's operation document (such as public, internal, secret, confidential, top secret), and the third step is to record the user's operation information (such as the unique identifier of the operation document, document name, operation type, operation time, etc.). The operation types are divided into reading, copying, editing, printing, screenshot, decryption, encryption, save as, renaming, deleting, adding tags, modifying tags, deleting tags, etc.

[0063] The data storage probe transfers the above-mentioned information and user terminal information (such as host name, MAC, machine code, IP address, terminal confidentiality level) monitored to the electronic document confidentiality level marking system database;

[0064] Apache probe combines strategies and database information for mining and analysis, and uses the data retrieval engine to retrieve and count user data, file distribution, violation alerts, user operations, terminal information, and operation rankings based on multi-dimensional retrieval conditions, and writes the analyzed data back to the database; the front-end user interface displays the query status.

[0065] The embodiment of the present application realizes a data probe device that can perform incremental data transmission and deep mining of the full life cycle data of monitored electronic files and user operation data in a confidential environment with the help of a dedicated client and a dedicated server, thereby solving the problem that the existing electronic confidentiality mark management system for security products is unable to actively collect operation information and issue early warnings in massive data.

[0066] The embodiment of the present application is a data probe device that can incrementally transmit and deeply mine electronic file full life cycle monitoring data and user operation data between a dedicated client and a dedicated server in a confidential environment using a data probe composed of a file system probe, a database storage probe, and an Apache probe. The device is commonly used in existing security product electronic classification mark management systems, and can work together with electronic classification mark management systems to provide a standardized interface for docking with electronic classification mark management systems and other application systems, making subsequent secondary use of the device more convenient and promoting the popularization and use of the device in a confidential environment. At the same time, it reduces the manpower and material resources spent on statistical data, further saving costs.

[0067] Based on the data audit method based on a confidential environment provided in the above embodiment, the embodiment of the present application also provides a data audit device based on a confidential environment.

[0068] The present application provides a data auditing device based on a confidentiality environment, including:

[0069] A data acquisition module is used to acquire the operations of the terminal user in the confidential environment through the file system probe to obtain the data to be processed;

[0070] The data reporting module is used to monitor the data to be processed through the database storage probe and report the monitored changed data;

[0071] The data audit module is used to mine and analyze the data reported by the database storage probe through the Apache probe and to audit the operations of the terminal users.

[0072] In one example, the device may further include:

[0073] The statistical analysis module is used to collect and analyze data, count and display audit information; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

[0074] Based on the data audit method and device based on a confidential environment provided in the above embodiments, the embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed, any one of the data audit methods based on a confidential environment provided in the above embodiments is implemented.

[0075] Based on the data auditing method based on a confidential environment provided in the above embodiment, the embodiment of the present application also provides a terminal including a memory and a processor; a computer program is stored in the memory, and when the processor runs the computer program, any one of the data auditing methods based on a confidential environment provided in the above embodiment is implemented.

[0076] The present application is described in detail above in conjunction with the accompanying drawings and embodiments, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge of ordinary technicians in the field without departing from the purpose of the present application. Any content not described in detail in the present application can adopt the existing technology.

Claims

1. A data audit method based on a confidentiality environment, characterized in that: The method comprises: The file system probe is used to obtain the operations of the terminal users in the confidential environment and obtain the data to be processed; Monitor the data to be processed through database storage probes and report the monitored data changes; The data reported by the database storage probe is mined and analyzed through the Apache probe, and the operation of the terminal user is audited.

2. The data audit method based on a confidential environment according to claim 1 is characterized in that: The process of obtaining the operations of the terminal user in the confidential environment through the file system probe to obtain the data to be processed specifically includes: The file system probe monitors the creation, modification and deletion events of the operation files in real time to obtain the data to be processed; The data to be processed is reported via the WebSocket protocol.

3. The data audit method based on a confidential environment according to claim 1 is characterized in that: The method of monitoring the data to be processed by the database storage probe and reporting the monitored changed data specifically includes: The database listener is used to monitor document data, user data, and department data, and the incremental transmission method is used to report the monitored changed data through the WebSocket protocol.

4. The data audit method based on a confidential environment according to claim 1 is characterized in that: The mining and analysis of the data reported by the database storage probe by using the Apache probe and the auditing of the terminal user's operation specifically include: The data reported by the database storage probe is preliminarily screened and classified for storage, and FastJson is used to mine and analyze user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of annotations, and number of secret codes.

5. The data audit method based on a confidential environment according to any one of claims 1 to 4, characterized in that: The data reported by the database storage probe is mined and analyzed by the Apache probe, and the operation of the terminal user is audited, and then the following is further included: After data collection and analysis, audit information is counted and displayed; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

6. The data audit method based on a confidential environment according to claim 5 is characterized in that: The audit information is presented through data collection and analysis, and then includes: Based on the audit information, an early warning is issued if the user's confidentiality level does not match the corresponding confidentiality level ciphertext storage quantity or if a user violates the regulations.

7. A data audit device based on a confidential environment, characterized in that: The device comprises: A data acquisition module is used to acquire the operations of the terminal user in the confidential environment through the file system probe to obtain the data to be processed; The data reporting module is used to monitor the data to be processed through the database storage probe and report the monitored changed data; The data audit module is used to mine and analyze the data reported by the database storage probe through the Apache probe and to audit the operations of the terminal users.

8. The data auditing device based on a confidentiality environment according to claim 7, characterized in that: The device further comprises: The statistical analysis module is used to collect and analyze data, count and display audit information; the audit information includes: data detection, user violations, number of ciphertexts, behavioral concerns, terminal information, ciphertext distribution, number of tags and number of confidentiality.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, the data audit method based on a confidential environment as described in any one of claims 1 to 6 is implemented.

10. A terminal, characterized in that: It comprises a memory and a processor; a computer program is stored in the memory, and when the processor runs the computer program, the data audit method based on a confidential environment as described in any one of claims 1 to 6 is implemented.

Images