A data sensitivity security grading evaluation method and device

Abstract

The application provides a data sensitivity security grading evaluation method and device. The method comprises the following steps: reading log content associated with a sensitivity influence factor from an access log of a data system at one time, wherein the sensitivity influence factor at least comprises an access personnel, an access time, an access source and an access frequency; classifying the log content according to a preset influence item classification rule and assigning a corresponding influence item score, wherein the influence item classification rule gives a unique and determined score interval for each influence item; calculating a sensitivity value of each influence factor; calculating a data sensitivity value of the accessed data; comparing the data sensitivity value with a unique and determined value interval in a preset sensitivity grading rule table, and marking a corresponding security grade for the accessed data. The application realizes reproducible, automatic and real-time updated data sensitivity grading by using the quantitative rule loaded at one time, dynamically calculating and marking the data sensitivity grade by using the real-time access log.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, encryption or marking based on data sensitivity grading, and in particular, relates to a data sensitivity security grading evaluation method and device. BACKGROUND

[0002] In the digital environment, data has become a key production factor, and its leakage or misuse can directly lead to exposure of personal privacy, damage to business interests of enterprises, and even risk to national security. In order to reduce the above risks, the industry generally adopts the "data sensitivity grading" mechanism, that is, different sensitivity levels are assigned to data according to its content and use scenario, and differential management, protection and utilization strategies are matched, so as to realize controllable privacy and security in the whole data flow process.

[0003] The current typical data sensitivity grading process includes three core links: first, a sensitivity grading model is established to set the sensitivity level of data and develop management strategies corresponding to the level; second, data is classified and marked according to data content and attributes, so as to facilitate subsequent grading and access control; finally, differential access control and encryption measures are implemented for different sensitivity levels, for example, high sensitivity data adopts more stringent permission management and multi-layer encryption, and low sensitivity data adopts relatively loose protection.

[0004] However, the existing technology still has obvious deficiencies: first, the determination of the sensitivity level highly depends on manual or organizational subjective experience, and combined with the differences in laws and regulations and industry standards of different countries, it is difficult to form a unified and quantifiable grading standard; second, data sensitivity dynamically evolves with time, business scenarios and external environment, while the existing static model lacks a real-time updating mechanism and cannot timely reflect the changes in sensitivity, thereby causing lag in grading results and invalidation of protection strategies. SUMMARY

[0005] According to the above technical problems, a data sensitivity security grading evaluation method and device are provided. The present application dynamically calculates and marks the data sensitivity level by using real-time access logs through one-time loading of quantization rules, and realizes reproducible, automated and real-time updated data sensitivity grading.

[0006] The technical means adopted by the present application are as follows:

[0007] A data sensitivity security grading evaluation method comprises the following steps:

[0008] S1, reading the log content associated with the sensitivity influence factor from the access log of the data system at one time, wherein the sensitivity influence factor at least includes access personnel, access time, access source and access frequency;

[0009] S2, classifying the log content according to preset influence item classification rules and assigning corresponding influence item scores, wherein each influence item is given a unique and determined score interval by the influence item classification rules;

[0010] S3, calculating a sensitivity value of each influence factor;

[0011] S4, calculating a data sensitivity value of the accessed data;

[0012] S5, comparing the data sensitivity value with a unique and determined numerical interval in a preset sensitivity classification rule table, and marking a corresponding security classification for the accessed data.

[0013] Further, the sensitivity classification rule table, the influence item classification rules, the calculation formula of the sensitivity value of each influence factor, and the calculation formula of the data sensitivity value of the accessed data are stored in a sensitivity influence factor rule model database and read once before step S1.

[0014] Further, the sensitivity influence factors of the access personnel at least include an identity level, a permission level, and an authorized access situation, and the score and weight value of each influence item are uniquely determined in the influence item classification rules.

[0015] Further, the sensitivity influence factors of the access time at least include a major event guarantee period, a normal working time, and a non-working time, and the score and weight value of each influence item are uniquely determined in the influence item classification rules.

[0016] Further, in step S3, the calculation formula of the sensitivity value of each influence factor is as follows:

[0017]

[0018] wherein, is the number of influence items with valid values, is the total number of influence items, is the weight value corresponding to the influence item, is the influence item score, is the influence full score.

[0019] Further, in step S4, the calculation formula of the data sensitivity value of the accessed data is as follows:

[0020]

[0021] wherein, is the sensitivity value of the sensitivity influence factor, is the weight value corresponding to the influence item.

[0022] Further, the calculation of the data sensitivity value is triggered at any time to achieve dynamic and real-time classification of data sensitivity.

[0023] Further, after step S5, further comprising:

[0024] S6, sorting the calculated data sensitivity value from high to low, and generating a data sensitivity analysis report containing the sensitivity score and security classification.

[0025] The application also provides a data sensitivity security classification evaluation device, comprising:

[0026] The acquisition module is used to read the access log from the data system and read the sensitivity classification rule table, the influence item classification rule, the calculation formula of each influence factor, and the calculation formula of the data sensitivity value of the accessed data from the sensitivity influence factor rule model database at one time;

[0027] The processing module comprises an influence item calculation submodule, an influence factor calculation submodule, and a sensitivity value calculation submodule, wherein the influence item calculation submodule is used to execute the step S2, the influence factor calculation submodule is used to execute the step S3, and the sensitivity value calculation submodule is used to execute the step S4;

[0028] The generation module is used to execute the step S5 and the step S6 to output the data security classification mark and the data sensitivity analysis report.

[0029] Further, the processing module triggers the calculation of the data sensitivity value in real time to achieve dynamic and real-time classification of data sensitivity.

[0030] Further, the acquisition module, the processing module, and the generation module are integrated in the same computing device.

[0031] Compared with the prior art, the application has the following advantages:

[0032] 1. The data sensitivity security classification evaluation method provided by the application shields the deviation of the classification results caused by subjective judgment of different people and organizations and insufficient understanding of regulations, and replaces the subjective judgment caused by manual or regulation differences with quantifiable numerical calculation, so that the consistency and reproducibility of the classification results are achieved.

[0033] 2. The data sensitivity security classification evaluation method provided by the application triggers the recalculation of the sensitivity value at any time point, so that the classification strategy is adjusted in real time with changes in business scenarios, external events, or access modes, and the problem of lagging failure of traditional static models is avoided.

[0034] 3. The data sensitivity security classification assessment method provided by this invention features one-time reading of the rule base, batch parsing of logs, and pipelined calculation, which significantly reduces I / O and computational overhead and supports the high-concurrency classification requirements in large-scale data environments.

[0035] 4. The data sensitivity security classification assessment method provided by this invention achieves full-link automation from log input to classification marking and analysis report output through three hardware devices: acquisition module, processing module, and generation module, achieving a pluggable and easy-to-deploy engineering effect. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart of the method of the present invention.

[0038] Figure 2 This is a block diagram of the system structure of the present invention.

[0039] Figure 3 This is a structural block diagram of the computer device of the present invention. Detailed Implementation

[0040] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products or devices.

[0042] like Figure 1 As shown, the present invention provides a data sensitivity security classification assessment method, including:

[0043] S1, reading log content associated with the sensitivity impact factor from the access log of the data system at one time, the sensitivity impact factor at least including access personnel, access timing, access source and access frequency;

[0044] S2, classifying the log content according to a preset impact item classification rule and assigning a corresponding impact item score, the impact item classification rule giving a unique and determined score interval for each impact item;

[0045] S3, calculating the sensitivity value of each impact factor;

[0046] S4, calculating the data sensitivity value of the accessed data;

[0047] S5, comparing the data sensitivity value with a unique and determined numerical interval in the preset sensitivity classification rule table, and marking the corresponding security classification for the accessed data.

[0048] In specific implementation, as a preferred embodiment of the present application, the sensitivity classification rule table, the impact item classification rule, the calculation formula of the sensitivity value of each impact factor and the calculation formula of the data sensitivity value of the accessed data are stored in the sensitivity impact factor rule model database and read at one time before step S1.

[0049] In specific implementation, as a preferred embodiment of the present application, the sensitivity impact factor of the access personnel at least includes identity level, permission level and authorized access situation, and the score and weight value of each impact item are uniquely determined in the impact item classification rule. In this embodiment, some content impact items are also included in the impact factor, such as the access personnel impact factor, after obtaining the content, the content needs to be processed according to the corresponding rule, and the related content is put into the corresponding impact item classification. For example, the identity level of the access personnel (divided according to the importance of the position), the permission level (divided according to the access permission of the personnel), and the authorized access situation (whether the access permission is obtained after approval).

[0050] In specific implementation, as a preferred embodiment of the present application, the sensitivity impact factor of the access timing at least includes the period of major event guarantee (such as major events, major international activities, etc.), normal working hours and non-working hours, and the score and weight value of each impact item are uniquely determined in the impact item classification rule.

[0051] In specific implementation, as a preferred embodiment of the present application, in step S3, the calculation formula of the sensitivity value of each impact factor is as follows:

[0052]

[0053] Wherein, is the number of impact items with values meeting the conditions, is the number of influence items, is the weight value of the influence item, is the score of the influence item, is the full score value of the influence item.

[0054] In the embodiment, the identity level score of the access person is 4, the permission level score is 5, the authorized access condition score is 1; the identity level score is 4, the permission level weight is 3, the permission level weight value is 5, and the authorized access condition weight value is 3. The full score value of each influence item is 5. The access person influence factor sensitivity value is:

[0055]

[0056] For example, the access time influence item factor includes the major event protection period, normal working hours and non-working hours. The score of the major event protection period can be set to 5, the score of the normal working hours can be set to 1, and the score of the non-working hours can be set to 2. The weight is set to 5, the permission level weight value is 1, and the authorized access condition weight value is 3. The full score value of each influence item is 5. The access time influence factor sensitivity value is:

[0057]

[0058] In the implementation, as a preferred embodiment of the present application, in step S4, the calculation formula of the data sensitivity value of the accessed data is as follows:

[0059]

[0060] wherein, is the sensitivity value of the sensitivity influence factor, is the weight value of the influence item.

[0061] In the embodiment, the influence factor scores of the access person, the access time, the access source and the access frequency are 0.67, 0.71, 0.86 and 0.33 respectively, and the weights are 5, 3, 5 and 4 respectively. The corresponding data sensitivity value is:

[0062]

[0063] In the implementation, as a preferred embodiment of the present application, the calculation of the data sensitivity value is triggered at any time to realize the dynamic and real-time classification of data sensitivity.

[0064] In the implementation, as a preferred embodiment of the present application, after step S5, it further includes:

[0065] S6. Sort the calculated data sensitivity values ​​from high to low and generate a data sensitivity analysis report that includes sensitivity scores and security levels.

[0066] This invention also provides a data sensitivity security classification assessment device, such as... Figure 2 As shown, it includes:

[0067] The acquisition module is used to read access logs from the data system and read sensitivity classification rule tables, impact item classification rules, calculation formulas for the sensitivity values ​​of each impact factor, and calculation formulas for the data sensitivity values ​​of the accessed data from the sensitivity impact factor rule model database in one go.

[0068] The processing module includes an impact item calculation submodule, an impact factor calculation submodule, and a sensitivity value calculation submodule. The impact item calculation submodule is used to execute step S2 of the dynamic data sensitivity classification method based on access logs. The impact factor calculation submodule is used to execute step S3 of the dynamic data sensitivity classification method based on access logs. The sensitivity value calculation submodule is used to execute step S4 of the dynamic data sensitivity classification method based on access logs.

[0069] The generation module is used to execute step S5 and step S6 of the data sensitivity dynamic classification method based on access logs, so as to output data security classification tags and data sensitivity analysis reports.

[0070] In a specific implementation, as a preferred embodiment of the present invention, the processing module triggers the calculation of data sensitivity values ​​in real time to achieve dynamic and real-time classification of data sensitivity.

[0071] In a preferred embodiment of the present invention, the acquisition module, processing module and generation module are integrated within the same computing device.

[0072] A computer device, such as Figure 3 As shown, it includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the data sensitivity security classification assessment method described in any one of steps S1 to S6.

[0073] Example

[0074] A typical example is as follows:

[0075] Step 1: Read the Sensitivity Impact Factor Rule Model Database to obtain the impact factors and impact items.

[0076] Step 2, read the data access log of the existing data system according to the content of the influencing factor, and extract the log content associated with the influencing factor according to the configuration and perform simple analysis. The access personnel, access time, access source, access frequency, etc. Obviously, the content of these influencing factors can be directly extracted and analyzed from the data access log to obtain the corresponding results.

[0077] Step 3, read other auxiliary information from the data system, such as access person identity, permission definition, access approval information, etc. Combine the influencing factor and influencing item read in 1) to classify the log content (XX influencing factor XX influencing item) or calculate (XX data access frequency) and give the influencing item score according to the influencing item scoring rule.

[0078] In this embodiment, a typical data influencing item scoring rule table is as follows:

[0079]

[0080] Step 4, calculate the data sensitivity value of the influencing factor according to the aggregated information (influencing item content in step 3, influencing item weight in step 1) using the formula in step S3.

[0081] Step 5, calculate the data sensitivity value of the accessed data according to the aggregated information (influencing factor sensitivity value in step 4, influencing factor weight in step 1) using the formula in step S4.

[0082] Step 6, combine the definition of the sensitivity value classification rule table to mark the security classification of the accessed data or give the classification suggestion through information prompt (window, message, etc.).

[0083] In this embodiment, a typical data sensitivity classification rule table is as follows:

[0084]

[0085] Step 7, optionally, sort the calculated sensitivity value of the specified accessed data from high to low, and generate a data sensitivity analysis report.

[0086] In this embodiment, in order to speed up the running efficiency of the system, the sensitivity influencing factor rule model data of step 1, step 4 and step 5 can be read at one time. The existing data system of step 2 and step 3 can be read at one time.

[0087] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0088] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other manners. Among them, the above-described device embodiments are only illustrative, for example, the division of the units can be a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0089] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed on a plurality of units. Part or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0090] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0091] When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0092] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data sensitivity security classification assessment method, characterized in that, include: S1. Read the log content associated with the sensitive impact factors from the access log of the data system in one go. The sensitive impact factors include at least the access personnel, access time, access source and access frequency. S2. The log content is categorized according to the preset impact item classification rules and assigned corresponding impact item scores. The impact item classification rules give a unique and definite score range for each impact item. S3. Calculate the sensitivity value for each influencing factor using the following formula: in, The number of influence items that meet the conditions and have values. For the total number of all influencing items, The weights corresponding to the influencing items are the weight values. To influence the score of the item, To affect the full score; S4. Calculate the data sensitivity value of the accessed data; S5. Compare the data sensitivity value with the uniquely determined numerical range in the preset sensitivity classification rule table to mark the security classification corresponding to the accessed data.

2. The data sensitivity security classification assessment method according to claim 1, characterized in that, The sensitivity grading rule table, the influence item classification rule, the calculation formula for the sensitivity value of each influence factor, and the calculation formula for the data sensitivity value of the accessed data are all stored in the sensitivity influence factor rule model database and read once before step S1.

3. The data sensitivity security classification assessment method according to claim 1, characterized in that, The sensitivity factors of the visitors include at least identity level, permission level, and authorized access status, and the score and weight of each influence item are uniquely determined in the influence item classification rules.

4. The data sensitivity security classification assessment method according to claim 1, characterized in that, The sensitivity factors of the access timing include at least the period of major event protection, normal working hours and non-working hours, and the score and weight of each influencing item are uniquely determined in the influencing item classification rules.

5. The data sensitivity security classification assessment method according to claim 1, characterized in that, In step S4, the formula for calculating the data sensitivity value of the accessed data is as follows: in, The sensitivity value of the sensitivity factor. The weights are the corresponding weights for the influencing items.

6. The data sensitivity security classification assessment method according to claim 5, characterized in that, The calculation of the data sensitivity value is triggered at any time to achieve dynamic and real-time classification of data sensitivity.

7. The data sensitivity security classification assessment method according to claim 1, characterized in that, Following step S5, the following is also included: S6. Sort the calculated data sensitivity values ​​from high to low and generate a data sensitivity analysis report that includes sensitivity scores and security levels.

8. A data sensitivity security classification assessment device, characterized in that, This includes an acquisition module, a processing module, and a generation module integrated within the same computing device, wherein: The acquisition module is used to read access logs from the data system and read sensitivity classification rule tables, impact item classification rules, calculation formulas for the sensitivity values ​​of each impact factor, and calculation formulas for the data sensitivity values ​​of the accessed data from the sensitivity impact factor rule model database in one go. The processing module includes an impact item calculation submodule, an impact factor calculation submodule, and a sensitivity value calculation submodule. The impact item calculation submodule is used to execute step S2 of claim 1, the impact factor calculation submodule is used to execute step S3 of claim 1, and the sensitivity value calculation submodule is used to execute step S4 of claim 1. The processing module triggers the calculation of data sensitivity values ​​in real time to achieve dynamic and real-time classification of data sensitivity. The generation module is used to execute step S5 of claim 1 and step S6 of claim 7 to output a data security classification label and a data sensitivity analysis report.

9. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the data sensitivity security classification assessment method according to any one of claims 1-7.

Images