Data security management and control system
By constructing a three-dimensional permission model and a state machine-driven multi-level approval process, the problem of insufficient dynamic adjustment and full-process management in existing data security control systems is solved. This enables dynamic permission management and full-link traceability of data operations, reducing the risk of illegal data outflow.
Patent Information
- Application Number
- CN202511694815.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-18
- Publication Date
- 2026-02-10
AI Technical Summary
Existing data security management systems cannot dynamically adjust to user attributes and specific task scenarios, the approval process is disconnected from actual operation, and there is a lack of full-process data export permission management, which poses a risk of illegal data leakage.
Construct a three-dimensional permission model of user-operation behavior-data object, combine RBAC, ABAC and task-based permission strategies, adopt a state machine-driven multi-level approval process, monitor and export approval data in real time, ensure operation consistency through permission verification and dynamic filtering, and record full-link audit information.
It implements minimum necessary permission allocation, ensures that approved operations are consistent with actual execution, dynamically adjusts permissions, prevents illegal data outflow, and provides end-to-end traceability and auditability.
Smart Images
Figure CN121502808A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of data analysis technology, and more specifically, relates to a data security management system. Background Technology
[0002] As enterprises deepen their digital transformation, data has become a core asset, and the demand for data security management is becoming increasingly severe. However, existing data security management systems still have certain shortcomings: Existing management and control systems mostly adopt role-based access control, which can only realize the division of permissions at the role level and cannot be dynamically adjusted according to user attributes and specific task scenarios. There is a problem of the approval process being disconnected from actual operation. Moreover, existing systems generally lack full-process control over data export operations. Export permissions are only bound to user roles and no differentiated approval process is set according to data security level, which poses a risk of illegal data leakage due to lax approval. Summary of the Invention
[0003] In response to the problems raised in the prior art, the present invention provides a data security management and control system. Technical solution
[0004] To solve the above problems, the present invention adopts the following technical solution.
[0005] A data security management and control system includes an access control module, a cross-database unified management module, a monitoring and alarm module, a problem handling module, and a data export approval module; The access control module is used for fine-grained access control and management of users, establishing a correspondence between users, operational behaviors, and data objects to ensure consistency between the approval process and actual operations. The access control module includes a user information collection unit, an access control rule setting unit, and an access control verification and execution unit. The user information collection unit collects user identity information, job information, and business requirements. The access control rule setting unit sets different users' operational permissions for different data objects based on a preset access control strategy, combined with user information and data object attributes. The access control verification and execution unit verifies in real time whether a user's data operations comply with their assigned permissions. The cross-database unified management module is used to access various databases of different types and from different manufacturers, and to achieve unified management of cross-database or cross-type databases. The cross-database unified management module includes a database access interface unit and a unified data management unit. The database access interface unit provides an interface compatible with various database original equipment manufacturer systems to enable access to different databases. The unified data management unit performs unified configuration management, data dictionary management and metadata management for the different databases accessed. The monitoring and alarm module is connected to the cross-database unified management module and is used to monitor the operating status and data operation of each database in real time, and issue alarm signals according to preset alarm rules. The problem handling module is connected to the monitoring and alarm module, and is used to receive alarm signals and handle alarm problems automatically or semi-automatically according to the preset problem handling strategy. The data export approval module is connected to the permission control module and the cross-database unified management module. It is used to control the data export operation process, and to approve the data export before it is exported. Only data export operations that have been approved can be executed.
[0006] Preferably, the permission division strategy set by the permission rule setting unit includes one or more combinations of role-based access control strategy, attribute-based access control strategy and task-based access control strategy.
[0007] Furthermore, the database access interface unit supports relational database interfaces, non-relational database interfaces, and distributed database interfaces.
[0008] Preferably, the alarm rules of the monitoring and alarm module include detection rules for operations such as abnormal data access, abnormal data modification, abnormal data deletion, and abnormal data export, as well as detection rules for operating states such as abnormal database performance indicators and abnormal storage space.
[0009] Furthermore, the problem handling strategy of the problem handling module includes automatically blocking abnormal operations, automatically recording operation logs, automatically notifying relevant administrators, and automatically repairing minor problems.
[0010] Furthermore, the approval process of the data export approval module includes the applicant submitting a data export application, the approver reviewing the application, and the system generating an approval certificate based on the approval result. The validity of the approval certificate needs to be verified when the data export operation is executed.
[0011] Preferably, it also includes a data security audit module, which is used to audit and record all data operation behaviors within the system, including operation time, operation user, operation object, operation type, and operation result information, so as to facilitate subsequent security audit and traceability.
[0012] Furthermore, the data security audit module supports querying, statistics, analysis, and exporting of audit records, and can generate audit reports in various formats.
[0013] Furthermore, the permission control module also includes a permission change monitoring unit, which is used to monitor changes in user permissions and detect and alert on unauthorized permission change behaviors.
[0014] Furthermore, the cross-database unified management module also includes a data synchronization unit, which is used to realize data synchronization between different databases to ensure data consistency and integrity.
[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention constructs a three-dimensional permission model of user-operation behavior-data object, integrating RBAC, ABAC and task-based permission strategies to achieve minimum necessary permission allocation; the permission verification execution unit uses a triple mechanism of request interception, permission mapping and dynamic filtering to block unauthorized operations in real time. For example, when an ordinary employee attempts to export unauthorized confidential data, the system automatically filters sensitive fields and records audit logs to ensure that the approved operation is consistent with the actual execution.
[0016] The data export approval module adopts a state machine-driven multi-level approval process, dynamically generating approval nodes based on data security levels. After approval, a UUID credential with an expiration date is generated. The validity of the credential must be verified during export to prevent large-scale data from being released without approval. At the same time, combined with the dynamic filtering function of the access control module, sensitive fields are automatically de-identified during the export process. The audit module records the entire export process information, making the export operation traceable and auditable.
[0017] The data security audit module records operation details, context information, and approval relationships, supporting multi-dimensional analysis and providing a complete chain of evidence for tracing security incidents. The permission change monitoring unit detects unauthorized permission modifications in real time and prevents internal personnel from illegally escalating privileges through SMS alerts and operation retrospection.
[0018] Figure 1 This is a system flowchart of the present invention; Figure 2 This is a flowchart of the access control module in the system of the present invention; Figure 3 This is a flowchart of the cross-database unified management module in the system of the present invention; Figure 4 This is a flowchart of the monitoring and alarm module in the system of the present invention; Figure 5 The system of this invention provides a flowchart for exporting approval data. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of this application, but not all embodiments. Generally, the components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations.
[0020] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application. Example
[0021] like Figures 1-5 As shown, a data security management system includes an access control module, a cross-database unified management module, a monitoring and alarm module, a problem handling module, and a data export approval module.
[0022] In practical implementation, this mainly includes the refined implementation of the access control module: 3D permission model construction The user information collection unit synchronizes the enterprise organizational structure through the LDAP interface to obtain user identity ID, job level, project team, and business requirement tags.
[0023] It should be noted that the permission rule setting unit adopts a combination strategy of role-based access control and attribute-based access control: Role-based: "Database Administrator" is granted advanced access permissions such as "Cross-database Management" and "Permission Change". Attribute dimensions: Add time restrictions (accessible from 9:00 to 18:00 on weekdays) and data range restrictions (can only read test database data) to the "Intern" role. Task Dimension: A one-time permission of "source database read + target database write" is temporarily generated for the "data migration project" and will automatically expire after the task is completed. The permission verification execution unit triggers triple verification when a user initiates an operation request: Request interception: Capture SQL statements or API calls through proxy middleware; Permission mapping: Query the "User-Role-Operation Permission Table" to verify whether the user is qualified to perform the target operation; Dynamic filtering: For users who meet the basic permissions, the result set is further filtered based on the data object tags. For example, ordinary employees can only obtain de-identified customer mobile phone numbers. The permission change monitoring unit listens to the database table of the permission rule setting unit in real time. When it detects that a non-administrator account attempts to modify the permission policy, or that the number of permission changes in a single day exceeds the threshold (e.g., 50 times / hour), it immediately sends an SMS alarm to the administrator and triggers operation backtracking: through the audit module, it traces the IP address, operating account, and policy differences before and after the last 10 permission changes.
[0024] The database access interface unit adopts an adapter pattern to provide standardized access for different databases: Relational databases: Connect to MySQL and Oracle via JDBC drivers, and support SQL syntax conversion (such as converting Oracle PL / SQL into MySQL compatible statements); No relational databases: Access MongoDB and Redis via RESTful API, and encapsulate a unified CRUD operation interface; Distributed databases: For TiDB and OceanBase, cluster metadata information is obtained through a customized SDK. The unified data management unit establishes a global data dictionary to store the field definitions, data types, and security levels (such as "PII sensitive data" and "ordinary business data") of each database table. For example, when connecting the "user_info" table in the Oracle database and the "user_profile" table in the MySQL database, the "ID number" field is automatically mapped as a unified sensitive label, and key monitoring is triggered in the monitoring module. The data synchronization unit supports two synchronization modes: Real-time synchronization: Capture source database change events through database log parsing tools and transmit them to the target database via Kafka message queue to achieve millisecond-level data synchronization; Scheduled synchronization: For non-core data, a full synchronization task is set up at 2:00 AM every day. Before synchronization, the permission module verifies whether the initiating account has cross-database read and write permissions. During the synchronization process, the start / end time, data volume and error logs of each batch of synchronization are recorded.
[0025] Multi-dimensional alarm rule engine The alarm rule base of the monitoring and alarm module includes: Operational anomaly rules: An alarm is triggered when a single account initiates more than 30 "SELECT * FROM core table" operations within 10 minutes, or when high-risk statements such as "DROPTABLE" or "TRUNCATETABLE" are used. Performance anomaly rule: When the database CPU utilization exceeds 80% for 15 consecutive minutes or the remaining storage space is less than 10%, an automatic performance alarm will be generated. Cross-database exception rules: When a non-administrator account attempts to access more than 3 different types of databases simultaneously through a cross-database connection tool, it is marked as a suspicious operation. After receiving the alarm signal, the problem handling module executes a tiered response: Level 1 Response (Automatic Blocking): For confirmed SQL injection attacks, immediately block the source IP address for 24 hours and record it in the audit log; Level 2 handling (manual intervention): If an alarm is triggered for abnormal data export, the export task will be automatically paused and an email containing screenshots of the operation will be sent to the data security officer, pending manual approval for resumption; Level 3 handling (log recording): For low-risk performance alerts, only logs are recorded and continuous monitoring is triggered for the next 72 hours.
[0026] The data export approval module adopts a state machine-driven approval process: Application submission: Users select the range of data to be exported through the system front end (supports database / table level / field level filtering), and the system automatically associates with the permission module to verify whether they have the basic permission for "export application"; Multi-level approval: Based on the security level of the exported data (e.g., "Confidential" requires dual signatures from the department director and the TO, while "Ordinary" can be signed by the direct supervisor alone), approval nodes are dynamically generated through the workflow engine; Credential Verification: After approval, a UUID with a timestamp is generated as the approval credential. When exporting data, the cross-database management module calls the verification interface to confirm that the credential is valid and has not expired (default validity period is 4 hours) before allowing data to be transmitted through an encrypted channel (such as HTTPS). Process backtracking: All failed export applications are automatically marked with "Reason for Approval Rejection" in the audit module.
[0027] The data security audit module uses a distributed logging system to record the following key information: Operation details: including the user ID, operation time, operation type, and amount of data affected; Contextual information: the fingerprint of the device initiating the operation, the location of the IP address, and the associated approval credential number; Audit Analysis: Supports the generation of visual reports based on dimensions such as "Top 10 High-Risk Operations" and "Abnormal IP Access Trends," which administrators can view in real time through the dashboard.
[0028] The embodiments described above are merely preferred embodiments of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications, improvements, and substitutions without departing from the concept of the present invention, and these all fall within the protection scope of the present invention.
Claims
1. A data security management and control system, characterized in that, It includes a permission control module, a cross-database unified management module, a monitoring and alarm module, a problem handling module, and a data export approval module; The access control module is used for fine-grained access control and management of users, establishing a correspondence between users, operational behaviors, and data objects to ensure consistency between the approval process and actual operations. The access control module includes a user information collection unit, an access control rule setting unit, and an access control verification and execution unit. The user information collection unit collects user identity information, job information, and business requirements. The access control rule setting unit, based on a preset access control strategy and combined with user information and data object attributes, sets different users' operational permissions for different data objects. The permission verification execution unit verifies in real time whether the user's operation complies with the permissions granted to them when the user performs data operations. The cross-database unified management module is used to access various databases of different types and from different manufacturers, and to achieve unified management of cross-database or cross-type databases. The cross-database unified management module includes a database access interface unit and a unified data management unit. The database access interface unit provides an interface compatible with various database original equipment manufacturer systems to enable access to different databases. The unified data management unit performs unified configuration management, data dictionary management and metadata management for the different databases accessed. The monitoring and alarm module is connected to the cross-database unified management module and is used to monitor the operating status and data operation of each database in real time, and issue alarm signals according to preset alarm rules. The problem handling module is connected to the monitoring and alarm module, and is used to receive alarm signals and handle alarm problems automatically or semi-automatically according to the preset problem handling strategy. The data export approval module is connected to the permission control module and the cross-database unified management module. It is used to control the data export operation process, and to approve the data export before it is exported. Only data export operations that have been approved can be executed.
2. The data security management and control system according to claim 1, characterized in that: The permission rule setting unit sets permission division strategies including one or more combinations of role-based access control strategies, attribute-based access control strategies, and task-based access control strategies.
3. The data security management and control system according to claim 1, characterized in that: The database access interface unit supports relational database interfaces, non-relational database interfaces, and distributed database interfaces.
4. The data security management and control system according to claim 1, characterized in that: The alarm rules of the monitoring and alarm module include detection rules for operations such as abnormal data access, abnormal data modification, abnormal data deletion, and abnormal data export, as well as detection rules for operating states such as abnormal database performance indicators and abnormal storage space.
5. A data security management and control system according to claim 1, characterized in that, The problem handling strategy of the problem handling module includes automatically blocking abnormal operations, automatically recording operation logs, automatically notifying relevant administrators, and automatically repairing minor problems.
6. The data security management and control system according to claim 1, characterized in that: The approval process of the data export approval module includes the applicant submitting a data export application, the approver reviewing the application, and the system generating an approval certificate based on the approval result. The validity of the approval certificate needs to be verified when the data export operation is executed.
7. A data security management and control system according to claim 1, characterized in that, It also includes a data security audit module, which is used to audit and record all data operation behaviors within the system, including operation time, operation user, operation object, operation type, and operation result information, so as to facilitate subsequent security audits and traceability.
8. A data security management and control system according to claim 7, characterized in that, The data security audit module supports querying, statistics, analysis, and exporting of audit records, and can generate audit reports in various formats.
9. A data security management and control system according to claim 1, characterized in that, The permission control module also includes a permission change monitoring unit, which is used to monitor changes in user permissions and detect and alert on unauthorized permission change behaviors.
10. A data security management and control system according to claim 1, characterized in that, The cross-database unified management module also includes a data synchronization unit, which is used to synchronize data between different databases to ensure data consistency and integrity.