Data security gateway, data security processing method and product

Abstract

The invention provides a data security gateway, a data security processing method and a product, and belongs to the technical field of data security. The data security gateway comprises a user permission module used for configuring the access permission of any user for the API interface of any application service; the API management module is used for registering an API interface of any application service on the gateway in response to a registration operation, and configuring an access state of any API interface in response to a management operation; the data identification module is used for identifying whether target data corresponding to a target request of any user is sensitive data; and the strategy protection module is used for executing a security protection strategy corresponding to the target data according to whether the target data is sensitive data and the access state of the API interface corresponding to the target request. The invention aims to improve the data security of the application system.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data security, and specifically, to a data security gateway, a data security processing method and a product. Background Art

[0002] Data abuse is common in the flow of data between application systems, resulting in a large number of high-density data assets, high-authorization interfaces and unauthorized interfaces being accessed by low-authorization users and unauthorized systems. Therefore, how to achieve efficient and fast data permission access control during the flow, processing and analysis of massive data between application systems is also one of the pain points of various enterprises in the process of data security governance; the object of data security protection is the entire data in the application system. It is a common phenomenon that security issues are less considered at the beginning of application system design. Even if the designer will solve a system security problem from a single problem point in the early stage of design, the lack of overall data security considerations will also lead to difficulties in the later design and integration of application systems and data security protection measures, difficulty in technical docking and long rectification time. It is also common for data security protection measures to be bypassed by application systems.

[0003] In addition, traditional data security protection methods do not have access control and dynamic desensitization strategies for sensitive data, which can easily lead to the leakage of sensitive data, thereby causing the leakage of personal or scientific research information. Once the information is used by criminals, it may have a negative impact on social security and economic development.

[0004] Therefore, how to improve the data security of application systems is an urgent problem to be solved. Summary of the invention

[0005] The embodiments of the present application provide a data security gateway, a data security processing method and a product, aiming to improve the data security of an application system.

[0006] In a first aspect, an embodiment of the present application provides a data security gateway, the gateway comprising: User permission module, used to configure the access rights of any user to any application service API interface; An API management module, configured to register an API interface of any application service on the gateway in response to a registration operation, and to configure an access status of any API interface in response to a management operation; A data identification module is used to identify whether the target data corresponding to the target request of any user is sensitive data; The policy protection module is used to execute the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request.

[0007] Optionally, the user authority module is further used to: Get user information of any user, including user name, phone number, email address and identity.

[0008] Optionally, the API management module includes: An application service management unit, configured to register an API interface of any application service on the gateway in response to a registration operation, and to delete an API interface of any registered application service in response to a deletion operation; An API management unit, configured to configure the access status of any API interface to any one of a blacklisted state, a whitelisted state, a disabled state, and an enabled state in response to a management operation; Among them, the blacklisted state indicates that any sensitive data cannot be accessed based on the API interface; the whitelisted state indicates that the security protection strategy is not executed based on any data accessed by the API interface; the disabled state indicates that any data cannot be accessed based on the API interface; and the enabled state indicates that the corresponding security protection strategy is executed based on any data accessed by the API interface.

[0009] Optionally, the data identification module is configured with a data classification directory, a data grading directory and preset access rules; the data classification directory includes the classification of any data; the data grading directory includes the grading of sensitivity corresponding to different data of any classification; the access rules include the grading of sensitivity of any user to any data; The data identification module is used to: determine the target classification of the target data and the target grade corresponding to the target data under the target classification according to the target data corresponding to the target request of any user; and determine whether the target data is sensitive data for the user according to the user's grade of sensitivity to the target data.

[0010] Optionally, the policy protection module is used to: When the access status of the API interface corresponding to the target request is in a blank state, directly returning the target data to the user; When the target data is sensitive data, and the access status of the API interface corresponding to the target request is blacklisted or disabled, a first security protection strategy is executed, wherein the first security protection strategy is not to return the target data to the user and to display an inaccessible prompt; When the target data is sensitive data and the access status of the API interface corresponding to the target request is enabled, a second security protection strategy is executed, and the second security protection strategy performs a preset data desensitization operation on the target data.

[0011] Optionally, the gateway further includes: The user behavior analysis module is used to monitor and record the historical access behavior of any user and determine the user's access behavior baseline.

[0012] Optionally, the policy protection module further includes multiple triggers and multiple executors; the multiple triggers include triggers of API dimension, triggers of user dimension, triggers of application service dimension and triggers of data dimension; The trigger of the API dimension is used to collect historical data corresponding to any API interface; the trigger of the user dimension is used to collect historical data corresponding to any user; the trigger of the application service dimension is used to collect historical data corresponding to any application service, and the trigger of the data dimension is used to collect historical data corresponding to any data, and the historical data includes the number of visits, the total amount of data visited, and the frequency of visits; The multiple executors include a data watermark executor, a data desensitization executor, an alarm executor, a blacklist executor, a record executor, and a blocking / releasing executor; The policy protection module is used in the process of any user's target request accessing the target data. According to whether each trigger among the multiple triggers meets the corresponding protection trigger conditions, whether the target data is sensitive data, and the access status of the API interface corresponding to the target request, a target executor is selected from the multiple executors, and the security protection policy is executed on the target data through the target executor.

[0013] In a second aspect, an embodiment of the present application provides a data security processing method, which is applied to the data security gateway as described in the first aspect of the embodiment, and the method includes: In response to a target request from any user, verify whether the user has access rights to the API interface corresponding to the target request; When the user has access rights to the API interface corresponding to the target request, the target data corresponding to the target request will be obtained in the application service corresponding to the API interface; According to whether the target data is sensitive data and the access status of the API interface corresponding to the target request, the security protection strategy corresponding to the target data is executed.

[0014] In a third aspect, an embodiment of the present application provides a computer device, comprising: at least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the computer program, the data security processing method described in the second aspect of the embodiment is performed.

[0015] In a fourth aspect, an embodiment of the present application provides a non-volatile readable storage medium, wherein the non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the data security processing method described in the second aspect of the embodiment is executed.

[0016] Beneficial effects: The data security gateway provided in this embodiment includes a user authority module, an API management module, a data identification module and a policy protection module.

[0017] The user permission module is used to configure the access rights of any user to the API interface of any application service; the API management module registers the API interface of any application service on the gateway in response to the registration operation, and configures the access status of any API interface in response to the management operation; the data identification module is used to identify whether the target data corresponding to the target request of any user is sensitive data; the policy protection module is used to execute the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request.

[0018] First, when any user accesses data, it is determined whether the user has access rights to the API interface to prevent any user from accessing the API interface of any application service; then, by determining whether the target data that the user wants to access is sensitive data, the security protection strategy corresponding to the target data is executed according to whether the target data is sensitive data and the access status of the API interface, the security of the data of the application system is improved. The data security gateway decouples data security protection from the application system, which can improve data security without affecting the normal data services of the application system. The data security gateway also has wide adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0020] Figure 1 This is a functional module diagram of a data security gateway proposed in one embodiment of the present application; Figure 2 This is a functional module diagram of a data security gateway proposed in one embodiment of the present application; Figure 3 is a flowchart of the steps of a data security processing method provided by an embodiment of the present application; Figure 4 It is an execution diagram of a data security processing method proposed in an embodiment of the present application; Figure 5 is a schematic diagram of a computer device proposed in one embodiment of the present application; Figure 6 It is a schematic diagram of a non-volatile readable storage medium provided in one embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0022] API: Application Programming Interface, application programming interface.

[0023] With the development of science and technology, data security has attracted widespread attention. A large amount of personal sensitive information or sensitive data is stored in data centers, but the data may be accidentally leaked during circulation, sharing and transmission due to various reasons, such as the lack of data usage specifications, illegal operations by personnel, and incomplete data security protection technical means.

[0024] An application system refers to a specific software system that can meet the needs of specific users such as enterprise management and provide software with specific functions, such as office software, game software, etc.; an application system is usually composed of a user interface, application program, database, and operating system.

[0025] Data abuse is also common when data flows between application systems, resulting in a large number of high-density data assets, high-authorization interfaces and unauthorized interfaces being accessed by low-authorization users and unauthorized systems. Therefore, how to achieve efficient and fast data permission access control during the flow, processing and analysis of massive data between application systems is also one of the pain points of various enterprises in the process of data security governance.

[0026] The object of data security protection is the entire amount of data in the application system. It is a common phenomenon that security issues are given little consideration at the beginning of the application system design. Even if the designer will start from a single problem point to solve a system security problem in the early stage of design, due to the lack of overall data security considerations, it will also lead to difficulties in the later design and integration of the application system and data security protection measures, difficulty in technical docking, and long rectification time. It is also common for data security protection measures to be bypassed by the application system.

[0027] In addition, traditional data security protection methods do not have access control and dynamic desensitization strategies for sensitive data, which can easily lead to the leakage of sensitive data, thereby causing the leakage of personal or scientific research information. Once the information is used by criminals, it may have a negative impact on social security and economic development.

[0028] Therefore, how to improve the data security of the application system is an issue that needs to be addressed urgently. Based on this, an embodiment of the present application provides a data security gateway.

[0029] Reference Figure 1 , showing a functional module diagram of a data security gateway in an embodiment of the present application. The data security gateway can be applied to any application system. The data security gateway provided in this embodiment is a gateway for data security protection between a user client, a data acquisition terminal and an application system that provides business services. The data security gateway aims to decouple the security system from the application system and provides a flexibly scalable, distributed, and data protection-capable gateway system.

[0030] Specifically, the data security gateway includes a user authority module, an API management module, a data identification module and a policy protection module.

[0031] The user permission module is used to configure the access rights of any user to the API interface of any application service.

[0032] For example, the application system includes multiple application services, each application service includes one or more API interfaces, different users can access different application services, and when a user accesses an application service, he or she may not have access rights to all API interfaces of the application service.

[0033] Therefore, first configure the access rights of any user to the API interface of any application service in the data security gateway. For example, user A has access rights to API interface 1 and API interface 3 of application service 1, user B has access rights to API interface 1, API interface 2 and API interface 3 of application service 1, and has access rights to API interface 4, API interface 5 and API interface 6 of application service 2.

[0034] In the actual implementation process, in addition to maintaining any user's access rights to the API interface, the user permission module also maintains any user's user information. For example, the user permission module is also used to obtain any user's user information, and the user information includes but is not limited to user name, phone number, email address and identity.

[0035] The API management module is used to register the API interface of any application service on the gateway in response to a registration operation, and to configure the access status of any API interface in response to a management operation.

[0036] In the actual implementation process, in order to enable any application service in the application system to have the data security protection function provided by the data security gateway, it is necessary to register the application service on the data security gateway, including registering the API interface of the application service.

[0037] Specifically, registering the API interface of any application service includes automatic registration. For example, all application services of the application system are first registered on the data security gateway applied to the application system. When any API interface of any application service is accessed, the API interface is automatically registered on the data security gateway. Any API interface of any application service can also be pre-registered on the data security gateway applied to the application system.

[0038] After registering the API interface of any application service on the data security gateway, the access status of any API interface can also be modified.

[0039] The access status of an API interface includes any of the following: blacklisted, whitelisted, disabled, and enabled. For any API interface: If the API interface is blacklisted, no sensitive data can be accessed through the API interface; If the API interface is in the whitelisted state, the data accessed through the API interface will not be processed regardless of whether it contains sensitive data, and the data will be directly returned to the requesting user; If the API interface is disabled, users cannot access any data through the API interface; If the API interface is enabled, the corresponding security protection policy is determined and executed for the data accessed through the API interface.

[0040] The data identification module is used to identify whether the target data corresponding to the target request of any user is sensitive data; In the actual implementation process, when any user accesses the data of the corresponding application service through an API interface with access rights, it is necessary to determine whether the data is sensitive data for the user. For example, for the phone number data of multiple users, user A can access the complete phone number data, but although user B can obtain the phone number data, he cannot intuitively see any of the entire phone numbers, and user C cannot access the phone number data.

[0041] According to the needs of actual applications, the data can be first classified according to the content of the data, such as telephone number data, identity information data, business data A...business data n, etc.; then under each data classification, the corresponding level of the data classification is determined, which represents different levels of sensitivity. For example, the telephone number data is divided into the first level, the second level and the third level, among which the first level is more sensitive than the second level, and the second level is more sensitive than the third level.

[0042] And preset the sensitivity level classification of any user corresponding to any type of data, so as to determine whether any data is sensitive data for the user.

[0043] For example, the target data obtained by user A is classified as telephone number data, and the target data corresponds to the first level under the telephone number data classification, and the sensitivity level of user A in the telephone number data classification is classified as the third level, then the target data is sensitive data for user A.

[0044] The target data obtained by user B is classified as telephone number data, and the target data corresponds to the second level under the telephone number data classification, while the sensitivity level of user B in the telephone number data classification is the first level, so the target data is not sensitive data for user B.

[0045] During the actual implementation process, different data classifications and different data classifications can be customized according to the needs of actual applications, or functions such as data recognition engines, data intelligent classification engines, and data intelligent grading engines can be used. The data intelligent classification engine maintains the data classification directory based on the leading national standards, local standards, industry standards, enterprise standards and other standard specifications, combined with the actual business situation, and uses artificial intelligence algorithms to automatically classify the data; the data intelligent grading engine maintains the data classification directory based on the leading national standards, local standards, industry standards, enterprise standards and other standard specifications, combined with the actual business situation, and uses artificial intelligence algorithms to automatically classify the data; the data recognition engine uses artificial intelligence algorithms to identify the data based on the data classification directory and data grading directory, combined with the actual business situation, to determine the sensitivity of the data.

[0046] The policy protection module is used to execute the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request.

[0047] In the actual implementation process, whether the target data requested by the user is sensitive data for the user and the access status of the API interface corresponding to the target request are used as comprehensive conditions to determine whether security protection is performed on the target data. If security protection is required, the security protection strategy can be executed on the target data. If security protection is not required, the target data obtained from the application service can be directly returned to the user.

[0048] Reference Figure 2 , showing a functional module diagram of a data security gateway provided in an embodiment of the present application, the data security gateway includes a user authority module, an API management module, a data identification module, a policy protection module and a user behavior analysis module.

[0049] Specifically, the user permission module is used to configure the access rights of any user to the API interface of any application service, and maintain the user information of any user, including but not limited to the user name, phone number, email address and identity.

[0050] The API management module includes an application service management unit and an API management unit, wherein: The application service management unit is used to register the API interface of any application service on the gateway in response to a registration operation, and to delete the API interface of any registered application service in response to a deletion operation. In addition to newly registering or deleting registered application services on the data security gateway, any application service can also be disabled. When the application service is disabled, all API interfaces of the application service are disabled.

[0051] The API management unit is used to configure the access status of any API interface to any one of a blacklisted state, a whitelisted state, a disabled state, and an enabled state in response to a management operation; The blacklisted status indicates that any sensitive data cannot be accessed based on the API interface.

[0052] The whitened state indicates that any data accessed based on the API interface does not execute the security protection strategy.

[0053] The disabled state indicates that any data cannot be accessed based on the API interface.

[0054] The enabled state represents the execution of a corresponding security protection strategy based on any data accessed by the API interface.

[0055] The data identification module is configured with a data classification directory, a data grading directory and preset access rules; the data classification directory includes the classification of any data; the data grading directory includes the sensitivity classification corresponding to different data of any classification; the access rules include the sensitivity classification of any user to any data.

[0056] In the process of users obtaining target data, the data identification module determines the target classification of the target data and the target grade corresponding to the target data under the target classification based on the target data corresponding to the target request of any user; and determines whether the target data is sensitive data to the user based on the user's grade of sensitivity to the target data.

[0057] If the user's sensitivity rating for the target data is higher than or equal to the target rating of the target data, the target data is not sensitive data for the user; if the user's sensitivity rating for the target data is lower than the target rating of the target data, the target data is sensitive data for the user.

[0058] The process in which the policy protection module executes the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request includes: When the access status of the API interface corresponding to the target request is in a blank state, the target data is directly returned to the user.

[0059] If the access status of the API interface is whitelisted, the security protection policy will not be executed for any data accessed based on the API interface. Therefore, regardless of whether the target data corresponding to the target request is sensitive data, there is no need for a security protection policy. The data security gateway directly releases the target data and returns it to the user.

[0060] When the target data is sensitive data, and the access status of the API interface corresponding to the target request is blacklisted or disabled, a first security protection strategy is executed, wherein the first security protection strategy is not to return the target data to the user and to display an inaccessible prompt; If the access status of the API interface is blacklisted, no sensitive data can be accessed based on the API interface. Therefore, if the target data is sensitive data, the first security protection strategy is executed, the target data is not returned to the user, and an inaccessible prompt is displayed.

[0061] If the access status of the API interface is disabled, no data can be accessed based on the API interface. Therefore, whether the target data is sensitive data or not, the first security protection strategy is executed, that is, the target data is not returned to the user and an access failure prompt is displayed.

[0062] In the actual implementation process, when executing the first security protection strategy, the inaccessibility prompt displayed to the user may also include the reason for the inaccessibility, such as displaying that the access status of the corresponding API interface is blacklisted or disabled.

[0063] When the target data is sensitive data and the access status of the API interface corresponding to the target request is enabled, a second security protection strategy is executed, and the second security protection strategy performs a preset data desensitization operation on the target data.

[0064] If the access status of the API interface is disabled, the corresponding security protection strategy will be executed based on any data accessed by the API interface. Therefore, if the target data is sensitive data at this time, the second security protection strategy will be executed to perform a preset data desensitization operation on the target data to improve the security of sensitive data.

[0065] Data desensitization operations transform sensitive data through specific rules or algorithms, including but not limited to replacement, rearrangement, encryption, truncation and masking, among which: ‌Replace‌‌, which replaces sensitive data with common values ​​or randomly generated data; ‌Rearrangement‌, that is, changing the order of data to hide the real information; ‌Encryption‌ means using encryption algorithms to encrypt data, which can be either symmetric or asymmetric. ‌Truncation‌ means intercepting part of the data and hiding the complete information.

[0066] ‌Masking‌ means replacing sensitive information with specific characters (such as "X" or "*"). For example, in the data of telephone number or ID card number, the middle part of the number is covered with "*".

[0067] The user behavior analysis module is used to monitor and record the historical access behavior of any user and determine the access behavior baseline of the user.

[0068] The user behavior analysis module determines the user's access behavior baseline by collecting and analyzing the user's historical access data. For example, based on the user's historical access data within a preset time (such as half a year), the user's most frequently accessed access behavior is determined as the user's access behavior baseline. The same access behavior can be the same application service accessed, or the same API interface for accessing the same application service.

[0069] By monitoring the historical access behavior of any user and determining the user's access behavior baseline, we can judge the deviation between the user's current access behavior and the access behavior baseline, determine whether the user's current access behavior is abnormal access behavior, and identify potential security threats and unauthorized access attempts.

[0070] The determination of the deviation between the current access behavior and the access behavior baseline may be set according to actual application requirements, including the deviation of the application service accessed and the deviation of the API interface of the application service accessed.

[0071] For example, if the access behavior baseline of user A is accessing application service A, and the current access behavior of user A is accessing application service B, the current access behavior of accessing application service B may be regarded as an abnormal access behavior.

[0072] If the access behavior baseline of user A is to access API interface 1 of application service A, and the current access behavior of user A is to access API interface 3 of application service A, then the current access behavior of accessing the API interface of application service A can be regarded as abnormal access behavior.

[0073] In a feasible implementation, in addition to determining the security protection policy to be executed on the target data based on whether the target data is sensitive data to the user and the access status of the accessed API interface, the policy protection module can also determine whether to execute the security protection policy on the target data by statistically analyzing historical data in different dimensions.

[0074] Specifically, the policy protection module also includes multiple triggers and multiple executors. Each trigger in the multiple triggers is used to determine whether the current access behavior meets the corresponding protection trigger condition. If the protection trigger condition is met, multiple executors are triggered to execute the target data to execute the security protection policy.

[0075] The multiple triggers include triggers of API dimension, triggers of user dimension, triggers of application service dimension and triggers of data dimension, wherein: The trigger of the API dimension is used to collect historical data corresponding to any API interface, including: The number of API calls during a specified period of time (a certain date, time, weekday, holiday, etc.); The amount of data accessed by a single API call; How often the API accesses data; The total number of API access data; Behavioral baseline for API access data; API blacklist and whitelist.

[0076] The user dimension trigger is used to collect historical data corresponding to any user, including: The number of calls made by users at a specified time (a certain date, time, weekday, holiday, etc.); The amount of data a user accesses in one call; How often users access data; The total number of users accessing data; Access behavior baseline of users accessing data; User blacklist and whitelist.

[0077] The trigger of the application service dimension is used to collect historical data corresponding to any application service, including: The number of times the application service is called during a specified period of time (a certain date, time, weekday, holiday, etc.); How often the application service accesses the data; The total amount of data accessed by the application service; Behavioral baseline of application services accessing data; Application service blacklist and whitelist.

[0078] The trigger of the data dimension is used to collect historical data corresponding to any data, including: Access behavior to data within date and time; Access behavior to different categories of data; Access to different levels of data; Frequency of access to data; The number of accesses to the data.

[0079] The multiple executors include a data watermark executor, a data desensitization executor, an alarm executor, a blacklist executor, a record executor, and a blocking / releasing executor, wherein: The data watermark executor is used to add data watermarks to data and can support three types of data watermarks: robust watermarks, fragile watermarks, and plaintext watermarks.

[0080] The data desensitization executor is used to perform data desensitization operations on data according to predefined rules. The supported desensitization methods include but are not limited to desensitization techniques such as generalization, interference, and suppression.

[0081] The alarm executor is used to issue alarms for data access behaviors. The alarm methods include recording alarm logs, sending alarm messages, sending alarm emails, sending alarm SMS, making alarm phone calls, and sending alarm 5G messages.

[0082] The blacklist executor is used to add the subject of data access behavior to the blacklist, including adding the subject to the blacklist with at least one of the user, the IP address from which the request is initiated, the API interface, and the application service as an identifier, thereby blocking future access.

[0083] The recording executor is used to record data access behaviors. It can be recorded in log files, log systems, message queues, and blockchains, etc., to facilitate auditing and tracing of access behaviors.

[0084] The blocking / releasing executor is used to block or release data access behavior.

[0085] For example, in addition to providing security protection for sensitive data, multiple triggers can also monitor historical data in multiple dimensions, and then determine whether each trigger meets its own preset protection trigger conditions under the current access behavior. When the protection trigger conditions are met, multiple executors are triggered to execute the target data to execute the security protection strategy.

[0086] In the actual implementation process, multiple triggers can be logically combined, such as AND, OR, and NOT logically processed to form a new trigger; multiple executors can connect the data watermark executor, data desensitization executor, alarm executor, blacklist executor and recording executor in parallel, and then connect them in series with the blocking / release executor.

[0087] During the process of any user's target request to access the target data, the policy protection module selects a target executor from the multiple executors based on whether each trigger among the multiple triggers meets the corresponding protection trigger conditions, whether the target data is sensitive data, and the access status of the API interface corresponding to the target request, and executes the security protection policy on the target data through the target executor.

[0088] When one or more triggers meet their corresponding protection triggering conditions, the rule for determining the target executor may be a preset rule.

[0089] For example, when the target data is not sensitive data for the user, but the total amount of data accessed by the user exceeds the preset total amount of accessed data, a data watermark executor, an alarm executor, a recording executor and a blocking / releasing executor may be selected as target executors.

[0090] That is, the data watermark executor adds a watermark to the target data, then the alarm executor sends an alarm SMS to the user, the recording executor records that the total amount of user access data exceeds the preset total amount of access data, and finally the target data with the watermark added is returned to the user through the blocking / releasing executor.

[0091] The data security gateway provided in this embodiment configures the access rights of any user to the API interface of any application service through the user permission module; the API management module registers the API interface of any application service on the gateway in response to the registration operation, and configures the access status of any API interface in response to the management operation; the data identification module is used to identify whether the target data corresponding to the target request of any user is sensitive data; the policy protection module is used to execute the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request, thereby improving the security of the data of the application system, and the data security gateway decouples the security protection of the data from the application system, which can improve the data security without affecting the normal data service of the application system, and the data security gateway also has a wide range of adaptability.

[0092] Reference Figure 3 , shows a flow chart of the steps of a data security processing method provided in an embodiment of the present application, which is applied to the data security gateway described in this embodiment, and the method includes the following steps: S101: In response to a target request of any user, verify whether the user has access rights to the API interface corresponding to the target request.

[0093] That is, first determine whether the user has the access permission to the API interface corresponding to the target request.

[0094] When the user does not have the access permission to the API interface corresponding to the target request, a prompt indicating that the access permission verification of the API interface has failed is directly returned to the user.

[0095] S102: When the user has access rights to the API interface corresponding to the target request, the target data corresponding to the target request is obtained in the application service corresponding to the API interface.

[0096] After the application service returns the target data corresponding to the target request, it is necessary to determine whether a security protection policy needs to be implemented on the target data.

[0097] S103: Execute a security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request.

[0098] For example, when the access status of the API interface corresponding to the target request is in a whitelisted state, the target data is directly returned to the user.

[0099] When the target data is sensitive data and the access status of the API interface corresponding to the target request is blacklisted or disabled, a first security protection strategy is executed, wherein the first security protection strategy is not to return the target data to the user and to display an inaccessible prompt.

[0100] In the actual implementation process, when executing the first security protection strategy, the inaccessibility prompt displayed to the user may also include the reason for the inaccessibility, such as displaying that the access status of the corresponding API interface is blacklisted or disabled.

[0101] When the target data is sensitive data and the access status of the API interface corresponding to the target request is enabled, a second security protection strategy is executed, and the second security protection strategy performs a preset data desensitization operation on the target data.

[0102] It is also possible to select a target executor from the multiple executors based on whether each of the multiple triggers in the policy protection module meets the corresponding protection trigger conditions, whether the target data is sensitive data, and the access status of the API interface corresponding to the target request, and execute the security protection policy on the target data through the target executor.

[0103] Reference Figure 4 , shows the execution diagram of the data security processing method provided in the embodiment of the present application. When the user initiates a request, the API interface corresponding to the request is first verified.

[0104] If the verification fails, a prompt indicating that the access permission verification of the API interface has failed will be directly returned to the user.

[0105] If the verification is successful, the request is sent to the application service and the target data returned by the application service is obtained.

[0106] Then, based on the collection of the user's historical access data, it is determined whether the user's current access behavior is abnormal.

[0107] If the user's current access behavior is not abnormal, continue to determine whether the data is sensitive data.

[0108] If the user's current access behavior is abnormal, a text message or email verification will be sent to the user. If the verification fails, a prompt indicating the verification failure will be directly returned to the user; if the verification succeeds, the system will continue to determine whether the data is sensitive data.

[0109] According to whether the target data is sensitive data and the access status of the API interface corresponding to the target request, the security protection policy corresponding to the target data is executed, or according to whether each of the multiple triggers in the policy protection module meets the corresponding protection trigger condition, whether the target data is sensitive data and the access status of the API interface corresponding to the target request, a target executor is selected from the multiple executors, and the target data is executed by the target executor with the security protection policy, and then returned to the user.

[0110] Reference Figure 5 , shows a schematic diagram of a computer device provided in an embodiment of the present application, comprising: at least one processor 501, and a memory 502, wherein the memory 502 stores a computer program that can be run on the processor 501, wherein the processor 501 executes the data security processing method described in the embodiment when executing the computer program.

[0111] Reference Figure 6 , shows a schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application, wherein the non-volatile readable storage medium 600 stores a computer program 601, wherein the computer program 601, when executed by a processor, performs the data security processing method described in the embodiment.

[0112] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0113] It should be understood by those skilled in the art that the embodiments of the present application can be provided as methods, devices or computer program products. Therefore, the embodiments of the present application can be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of the present application can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0114] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0117] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0118] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0119] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data security gateway, characterized in that: The gateway comprises: User permission module, used to configure the access rights of any user to any application service API interface; An API management module, configured to register an API interface of any application service on the gateway in response to a registration operation, and to configure an access status of any API interface in response to a management operation; A data identification module is used to identify whether the target data corresponding to the target request of any user is sensitive data; The policy protection module is used to execute the security protection policy corresponding to the target data according to whether the target data is sensitive data and the access status of the API interface corresponding to the target request.

2. The data security gateway according to claim 1, characterized in that: The user authority module is also used for: Get user information of any user, including user name, phone number, email address and identity.

3. The data security gateway according to claim 1, characterized in that: The API management module includes: An application service management unit, configured to register an API interface of any application service on the gateway in response to a registration operation, and to delete an API interface of any registered application service in response to a deletion operation; An API management unit, configured to configure the access status of any API interface to any one of a blacklisted state, a whitelisted state, a disabled state, and an enabled state in response to a management operation; Among them, the blacklisted state indicates that any sensitive data cannot be accessed based on the API interface; the whitelisted state indicates that the security protection strategy is not executed based on any data accessed by the API interface; the disabled state indicates that any data cannot be accessed based on the API interface; and the enabled state indicates that the corresponding security protection strategy is executed based on any data accessed by the API interface.

4. The data security gateway according to claim 1, characterized in that: The data identification module is configured with a data classification directory, a data grading directory and preset access rules; the data classification directory includes the classification of any data; the data grading directory includes the grading of the sensitivity of different data in any classification; the access rules include the grading of the sensitivity of any user to any data; The data identification module is used to: determine the target classification of the target data and the target grade corresponding to the target data under the target classification according to the target data corresponding to the target request of any user; and determine whether the target data is sensitive data for the user according to the user's grade of sensitivity to the target data.

5. The data security gateway according to claim 3, characterized in that: The policy protection module is used for: When the access status of the API interface corresponding to the target request is in a blank state, directly returning the target data to the user; When the target data is sensitive data, and the access status of the API interface corresponding to the target request is blacklisted or disabled, a first security protection strategy is executed, wherein the first security protection strategy is not to return the target data to the user and to display an inaccessible prompt; When the target data is sensitive data and the access status of the API interface corresponding to the target request is enabled, a second security protection strategy is executed, and the second security protection strategy performs a preset data desensitization operation on the target data.

6. The data security gateway according to claim 1, characterized in that: The gateway further comprises: The user behavior analysis module is used to monitor and record the historical access behavior of any user and determine the user's access behavior baseline.

7. The data security gateway according to claim 1, characterized in that: The policy protection module further includes multiple triggers and multiple executors; the multiple triggers include triggers of API dimension, triggers of user dimension, triggers of application service dimension and triggers of data dimension; The trigger of the API dimension is used to collect historical data corresponding to any API interface; the trigger of the user dimension is used to collect historical data corresponding to any user; the trigger of the application service dimension is used to collect historical data corresponding to any application service, and the trigger of the data dimension is used to collect historical data corresponding to any data, and the historical data includes the number of visits, the total amount of data visited, and the frequency of visits; The multiple executors include a data watermark executor, a data desensitization executor, an alarm executor, a blacklist executor, a record executor, and a blocking / releasing executor; The policy protection module is used in the process of any user's target request accessing the target data. According to whether each trigger among the multiple triggers meets the corresponding protection trigger conditions, whether the target data is sensitive data, and the access status of the API interface corresponding to the target request, a target executor is selected from the multiple executors, and the security protection policy is executed on the target data through the target executor.

8. A data security processing method, characterized in that: Applied to the data security gateway according to any one of claims 1 to 7, the method comprises: In response to a target request from any user, verify whether the user has access rights to the API interface corresponding to the target request; When the user has access rights to the API interface corresponding to the target request, the target data corresponding to the target request will be obtained in the application service corresponding to the API interface; According to whether the target data is sensitive data and the access status of the API interface corresponding to the target request, the security protection strategy corresponding to the target data is executed.

9. A computer device, characterized in that: include: At least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein the data security processing method of claim 8 is executed when the processor executes the computer program.

10. A non-volatile readable storage medium, characterized in that: The non-volatile readable storage medium stores a computer program, wherein the computer program, when executed by a processor, performs the data security processing method of claim 8.

Images