Data security binding label and separation label fusion generation and verification method

Abstract

The invention discloses a method for fusion generation and verification of a data security binding tag and a separation tag. The method comprises a process of fusion generation of the data security binding tag and the separation tag. And carrying out fusion verification on the data security binding label and the separation label. According to the application, the use and management process of the data security tag is simplified, the system complexity and the management cost are reduced, and the data security tag can be flexibly applied and managed based on different scenes.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method for generating and verifying data security binding tags and separation tags. Background Technology

[0002] Data security labeling technology, as a key means of ensuring data security, enables secure management and control of the entire data lifecycle by implementing identity feature identification and security attribute marking on data resources, including access control, traceability and data ownership confirmation, while data security binding and separation labels are widely used in different data processing scenarios.

[0003] Currently, data security binding is generally achieved through the generation of digital watermarks. Specifically, this involves embedding a digital watermark containing specific information (such as data owner, usage rights, and usage period) into the data. This method allows for tracing the data's origin and related usage rights by extracting the digital watermark when data is illegally used or disseminated. However, the generation process of digital watermarks is complex, requiring consideration of watermark visibility, robustness, tamper-proof characteristics, and the impact on the quality and performance of the original data after embedding the watermark. Furthermore, the digital watermark management system needs the ability to effectively store, query, and update large amounts of watermark information, which places high demands on the system's storage and computing resources. In addition, digital watermarks may be damaged during complex data processing and transformation operations, thus affecting their traceability and verification functions.

[0004] Currently, the primary approach for data delimiters is to generate unique identifiers independently and then perform associated retrieval. For example, each data file or dataset is assigned a unique identifier, and corresponding metadata records are created to store various attributes and security information about the data, facilitating subsequent queries and verifications. This approach offers some flexibility in data management because the management and updating of delimiters are relatively independent of the original data. However, it also has limitations. For instance, the association between delimiters and data requires additional mechanisms for maintenance, and tag queries and verification are less convenient than using bound tags that follow the data flow, especially under conditions of network isolation.

[0005] In summary, both bound tags and separate tags have their own advantages and disadvantages. Users or applications usually need to consider factors such as cost, scenario, and management difficulty to make appropriate trade-offs. Summary of the Invention

[0006] To address the aforementioned issues in the use and management of current data security binding and separation tags, this application provides a method for the integrated generation and verification of data security binding and separation tags. This method achieves a unified set of tag generation and verification methods, simplifying the use and management process of data security tags, reducing system complexity and management costs, and enabling flexible application and management of data security tags based on different scenarios.

[0007] This application discloses a method for generating and verifying data security binding tags and separation tags, which includes: Step 1: The process of merging and generating data security binding tags and separation tags; Step 2: The process of verifying the data security binding and separation of tags.

[0008] Further, step 1 includes: Submitting a tagging application: The application submits the raw data, data attributes, and signature key information, and calls the tag service interface to submit a tagging application; Calculate data hash: After receiving a tagging request, the tagging service uses the provided algorithm to perform a hash operation on the data to obtain the hash value of the data; Encapsulation and Tagging Application: The tag service encapsulates the data's hash value, data attributes, and other multi-dimensional information according to the unified tag format requirements, and submits it to the signing module for signing processing; Tag generation: The signing module checks whether the data already has a tag based on the hash value of the data. If it does, it returns an error message directly; otherwise, it encapsulates the tag format according to the application information, signs the tag information using the signing private key provided by the tag service, generates the tag, and stores the tag in the tag library to complete the tag signing. Tag processing: The tag service determines whether to generate bound tags based on application requirements. If so, it encapsulates the tags into the data and returns them; otherwise, it directly returns the tags to the application system.

[0009] Further, step 2 includes: Step 21: Submit the data for the tags to be verified; Step 22: Calculate the data hash: The applicant submits a tag verification application with the data of the tag to be verified as a parameter. The tag service uses local algorithm resources to calculate the hash value of the data of the tag to be verified. Step 23: The tag service checks whether the data of the tag to be verified has a bound tag. If there is a data security bound tag, proceed to step 24; otherwise, proceed to step 25. Step 24: Extract and parse the tag to be verified, obtain the tag attributes and signature information, and verify whether the tag ID is consistent with the hash value calculated in step 22. If they are consistent, verify whether the signature in the tag is correct. If it is correct, proceed to step 27. If they are inconsistent, proceed to step 25. Step 25: Query Tags: The tag service queries tags from the tag library based on the hash value calculated in step 22, parses the tag information, obtains data attributes and signature information, and executes step 26; Step 26: Verify the label: Locate the label issuer's certificate based on the signature information, and use the certificate to verify the issuer's signature. If the verification passes, proceed to step 27; otherwise, return a signature verification failure message. Step 27: Verification successful, return tag attributes.

[0010] Furthermore, in step 24, if the signature in the verification tag is incorrect, the signature verification fails.

[0011] Furthermore, prior to step 1, the procedure also includes: Different types of target data are abstracted into individual data and datasets with the same security attributes. The hash value of the individual data is used as the unique identifier of the individual data, i.e., the data ID; the hash value of the dataset expression is used as the unique identifier of the dataset, i.e., the dataset ID. The hash value of the dataset expression is a hash value of a preset condition; all data in the dataset satisfies the preset condition; the target data includes files, data blocks, and databases; the data ID and dataset ID are stored in a tag body with a unified tag format. The data ID and dataset ID are uniformly represented and placed in a unified label format. The data ID establishes a binding relationship between the label and the data, and the dataset ID establishes a binding relationship between the label and the dataset. The label is protected for integrity based on cryptographic algorithms to ensure the security and trustworthiness of the label itself, thus completing the issuance process of data security labels.

[0012] Furthermore, individual data and datasets share the same security attribute description format. After data abstraction, all target data are security-described using a unified label format.

[0013] Furthermore, tags are divided into separate tags and bound tags; an index relationship is established between separate tags and data: tags are stored in the database, and a mapping relationship is established between data ID or dataset ID and data or dataset to create an associated query index; an index relationship is established between bound tags and data: first, the tags are stored in the database as separate tags, and then the separate tags are embedded into the data after being encoded in a specified manner.

[0014] Furthermore, the step of first storing the data in the database using separate tags, and then embedding the separate tags into the data after specifying the encoding, includes: In addition to storing tags in the tag library, data security binding tags need to be embedded in the original data and flow with the data. This is achieved by embedding tags in a specified location in office files without affecting data usage: using custom attributes in the file format specification as the tag information carrier, the tags are written into the file to achieve tag binding.

[0015] Furthermore, binding tags are divided into explicit data security binding tags and implicit data security binding tags. When using explicit data security binding tags, the tag is embedded in the data header, and the tag must be removed before using the data. When using implicit data security binding tags, the tag is embedded in a specified location of a specified type of file, without affecting the use of the data.

[0016] Furthermore, the unified label format consists of a label header, a label body, and an issuer signature. The label header records the label's own attributes, including label type, label ID, and format version. The label body includes data attributes, data ID, and / or dataset ID, where the data ID is the hash value of the data, representing the uniqueness of the data. Data attributes include information describing business relevance, such as data security level, data category, data owner, and data permissions. The issuer signature records the label service's signature information for the label, providing integrity and authentication protection for the label.

[0017] Due to the adoption of the above technical solution, this application has the following advantages: 1. Simplified management process: This application implements the same management method for data security binding and separation, which changes the previous situation where different management mechanisms needed to be maintained separately. This greatly reduces management costs and complexity. Whether it is the generation, storage, transmission or use of data, it can be operated based on a unified management method, thereby improving overall management efficiency.

[0018] 2. Enhanced Business Flexibility: Tagging requests do not require multiple adaptations or integrations, reducing integration complexity while meeting diverse needs. Whether in data generation, storage, transmission, or usage, a unified method can be used for tagging and verification, allowing for flexible selection of tagging methods based on actual business scenarios.

[0019] 3. Optimized Label Embedding Management: When processing label binding, this application employs an optimized embedding algorithm and management strategy during the process of embedding the generated labels into the data. On the one hand, it minimizes the impact on the original data format and performance, ensuring that the data can still be processed and used normally and efficiently after the labels are embedded. On the other hand, to address maintenance issues, a management mechanism consistent with that of separate labels is established to ensure the consistency and integrity of embedded labels and data, thereby improving the reliability of label binding management throughout the entire data lifecycle. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0021] Figure 1 This is a schematic diagram illustrating the heterogeneous data tagging principle of an embodiment of this application.

[0022] Figure 2 This is a schematic diagram of the data security binding tag and separation tag fusion generation process in an embodiment of this application.

[0023] Figure 3 This is a schematic diagram of the data security binding tag and separation tag fusion verification process in an embodiment of this application.

[0024] Figure 4 This is a schematic diagram illustrating the data security label format and encapsulation principle of an embodiment of this application.

[0025] Figure 5 This is a schematic diagram of data security tag storage management according to an embodiment of this application.

[0026] Figure 6 This is a schematic diagram of the data embedding method for binding tags according to an embodiment of this application. Detailed Implementation

[0027] The present application will be further described in conjunction with the accompanying drawings and embodiments. The described embodiments are only some, not all, of the embodiments of the present application. All other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of the present application.

[0028] See Figure 2 and Figure 3 This application provides an embodiment of a method for generating and verifying data security binding tags and separation tags, which includes: Step 1: The process of merging and generating data security binding tags and separation tags; Step 2: The process of verifying the data security binding and separation of tags.

[0029] Optionally, step 1 includes: Submitting a tagging application: The application submits the raw data, data attributes, and signature key information, and calls the tag service interface to submit a tagging application; Calculate data hash: After receiving a tagging request, the tagging service uses the provided algorithm to perform a hash operation on the data to obtain the hash value of the data; Encapsulation and Tagging Application: The tag service encapsulates the data's hash value, data attributes, and other multi-dimensional information according to the unified tag format requirements, and submits it to the signing module for signing processing; Tag generation: The signing module checks whether the data already has a tag based on the hash value of the data. If it does, it returns an error message directly; otherwise, it encapsulates the tag format according to the application information, signs the tag information using the signing private key provided by the tag service, generates the tag, and stores the tag in the tag library to complete the tag signing. Tag processing: The tag service determines whether to generate bound tags based on application requirements. If so, it encapsulates the tags into the data and returns them; otherwise, it directly returns the tags to the application system.

[0030] Optionally, step 2 includes: Step 21: Submit the data for the tags to be verified; Step 22: Calculate the data hash: The applicant submits a tag verification application with the data of the tag to be verified as a parameter. The tag service uses local algorithm resources to calculate the hash value of the data of the tag to be verified. Step 23: The tag service checks whether the data of the tag to be verified has a bound tag. If there is a data security bound tag, proceed to step 24; otherwise, proceed to step 25. Step 24: Extract and parse the tag to be verified, obtain the tag attributes and signature information, and verify whether the tag ID is consistent with the hash value calculated in step 22. If they are consistent, verify whether the signature in the tag is correct. If it is correct, proceed to step 27. If they are inconsistent, proceed to step 25. Step 25: Query Tags: The tag service queries tags from the tag library based on the hash value calculated in step 22, parses the tag information, obtains data attributes and signature information, and executes step 26; Step 26: Verify the label: Locate the label issuer's certificate based on the signature information, and use the certificate to verify the issuer's signature. If the verification passes, proceed to step 27; otherwise, return a signature verification failure message. Step 27: Verification successful, return tag attributes.

[0031] Optionally, in step 24, if the signature in the verification tag is incorrect, the signature verification fails.

[0032] Optionally, in step 25, if no tag is found, an error is returned.

[0033] Optionally, before step 1, the method further includes: See Figure 1 This approach abstracts different types of target data into individual data and datasets with the same security attributes. The hash value of an individual data point serves as its unique identifier, i.e., the data ID. Similarly, the hash value of a dataset expression serves as the unique identifier, i.e., the dataset ID, which is a hash value based on preset conditions. All data within the dataset satisfies these preset conditions. Target data includes files, data blocks, and databases. The data ID and dataset ID are stored in a tag body with a unified tag format, the principle of which is as follows: Figure 3 As shown in Table 1, the correspondence between target data categories and data IDs represents the meaning of the data.

[0034] Table 1. Correspondence between target data categories and data ID meanings

[0035] See Figure 1 The system unifies the representation of data ID and dataset ID, places them in a unified label format, establishes a binding relationship between the label and the data through the data ID, and establishes a binding relationship between the label and the dataset through the dataset ID; it protects the integrity of the label based on cryptographic algorithms, ensures the security and trustworthiness of the label itself, and completes the issuance process of data security labels.

[0036] Optionally, individual data and datasets have the same security attribute description format. After data abstraction, all target data are security-described using a unified label format.

[0037] Optionally, tags can be divided into separate tags and bound tags; an index relationship can be established between separate tags and data: tags are stored in the database, and a mapping relationship is established between data ID or dataset ID and data or dataset to create an associated query index; an index relationship can be established between bound tags and data: first, the tags are stored in the database as separate tags, and then the separate tags are embedded into the data after being encoded in a specified manner.

[0038] Optionally, the storage management of data security tags applies to data security tags generated from all file types, databases, and other tagged objects. Regardless of whether integrated binding is required, they will be stored in the database as separate tags to ensure that data can be retrieved by associating it with tags through the tag / data mapping table in the tag library, achieving globally unified management. Figure 5As shown.

[0039] Optionally, the step of first storing the data in the database as separate tags, and then embedding the separate tags into the data after specifying the encoding, includes: Besides storing tags in a tag library, the bound tags need to be embedded in the original data and flow with the data. Considering methods such as embedding tags in the data header, tags must be removed before use to avoid affecting normal data usage. For common, frequently used office files (such as Word, Excel, PPT, and PDF), a method is adopted to embed tags in specific locations without affecting data usage. The specific method is to use custom attributes in the file format specification as tag information carriers, write the tags into the file, and realize tag binding, such as... Figure 6 As shown, the binding tag embedding process is completed in two steps: 1) Encode the tag's binary data using base64; 2) Create a custom attribute “SecurityTag” for the document and save the base64 encoded result of the tag as the attribute value of “SecurityTag”.

[0040] Optionally, binding tags are divided into explicit data security binding tags and implicit data security binding tags. When using explicit data security binding tags, the tags are embedded in the data header and must be removed before using the data. When using implicit data security binding tags, the tags are embedded in a specified location in a specified type of file (including Word, Excel, PPT, and PDF) without affecting the use of the data.

[0041] Optionally, see Figure 4 A unified tag format consists of a tag header, a tag body, and an issuer signature. The tag header records the tag's own attributes, including tag type, tag ID, and format version. The tag body includes data attributes, data ID, and / or dataset ID. The data ID is the hash value of the data, representing the uniqueness of the data. Data attributes include information describing business relevance, such as data security level, data category, data owner, and data permissions. The issuer signature records the tag service's signature information for the tag, providing integrity and authentication protection for the tag.

[0042] This application designs a unified set of rules and algorithms to generate data security tags and manages the tag library securely. This ensures that data security binding tags and delimited tags can be associated with each other within the same tag library, reducing the work of developing and maintaining different tag generation and management systems and improving efficiency. For data security binding tags, based on the same generation and management method, this application only needs to securely and effectively embed the generated tags into the original data, ensuring that the embedding process does not significantly affect the quality and performance of the original data. This application designs a unified tag verification process to ensure that data security binding tags and delimited tags can be efficiently verified based on unified rules.

[0043] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.

Claims

1. A method for generating and verifying data security binding tags and separation tags, characterized in that, include: Step 1: The process of fusing and generating data security binding tags and separation tags; Step 2: The process of verifying the data security binding and separation of tags.

2. The method according to claim 1, characterized in that, Step 1 includes: Submitting a tagging application: The application submits the raw data, data attributes, and signature key information, and calls the tag service interface to submit a tagging application; Calculate data hash: After receiving a tagging request, the tagging service uses the provided algorithm to perform a hash operation on the data to obtain the hash value of the data; Encapsulation and Tagging Application: The tag service encapsulates multidimensional information according to unified tag format requirements and submits it to the issuance module for issuance processing; the multidimensional information includes the data's hash value and data attributes; Tag generation: The signing module checks whether the data already has a tag based on the hash value of the data. If it does, it returns an error message directly; otherwise, it encapsulates the tag format according to the application information, signs the tag information using the signing private key provided by the tag service, generates the tag, and stores the tag in the tag library to complete the tag signing. Tag processing: The tag service determines whether to generate bound tags based on application requirements. If so, it encapsulates the tags into the data and returns them; otherwise, it directly returns the tags to the application system.

3. The method according to claim 1, characterized in that, Step 2 includes: Step 21: Submit the data for the tags to be verified; Step 22: Calculate the data hash: The applicant submits a tag verification application with the data of the tag to be verified as a parameter. The tag service uses local algorithm resources to calculate the hash value of the data of the tag to be verified. Step 23: The tag service checks whether the data of the tag to be verified has a bound tag. If there is a data security bound tag, proceed to step 24; otherwise, proceed to step 25. Step 24: Extract and parse the tag to be verified, obtain the tag attributes and signature information, and verify whether the tag ID is consistent with the hash value calculated in step 22. If they are consistent, verify whether the signature in the tag is correct. If it is correct, proceed to step 27. If they are inconsistent, proceed to step 25. Step 25: Query Tags: The tag service queries tags from the tag library based on the hash value calculated in step 22, parses the tag information, obtains data attributes and signature information, and executes step 26; Step 26: Verify the label: Locate the label issuer's certificate based on the signature information, and use the certificate to verify the issuer's signature. If the verification passes, proceed to step 27; otherwise, return a signature verification failure message. Step 27: Verification successful, return tag attributes.

4. The method according to claim 3, characterized in that, In step 24, if the signature in the verification tag is incorrect, the signature verification fails.

5. The method according to claim 1, characterized in that, Before step 1, the following are also included: Different types of target data are abstracted into individual data and datasets with the same security attributes. The hash value of the individual data is used as the unique identifier of the individual data, i.e., the data ID; the hash value of the dataset expression is used as the unique identifier of the dataset, i.e., the dataset ID. The hash value of the dataset expression is a hash value of a preset condition; all data in the dataset satisfies the preset condition; the target data includes files, data blocks, and databases; the data ID and dataset ID are stored in a tag body with a unified tag format. The data ID and dataset ID are uniformly represented and placed in a unified label format. The data ID establishes a binding relationship between the label and the data, and the dataset ID establishes a binding relationship between the label and the dataset. The label is protected for integrity based on cryptographic algorithms to ensure the security and trustworthiness of the label itself, thus completing the issuance process of data security labels.

6. The method according to claim 5, characterized in that, Individual data and datasets share the same security attribute description format. After data abstraction, all target data are security-described using a unified label format.

7. The method according to claim 5, characterized in that, The tags are divided into separate tags and bound tags; an index relationship is established between separate tags and data: the tags are stored in the database, and a mapping relationship is established between the data ID or dataset ID and the data or dataset to create an associated query index; Establish an index relationship between bound tags and data: first store them in the database as separate tags, and then embed the separate tags into the data after specifying the encoding.

8. The method according to claim 7, characterized in that, The process of first storing the data in the database using separate tags, and then embedding the separate tags into the data after specifying the encoding, includes: In addition to storing tags in the tag library, data security binding tags need to be embedded in the original data and flow with the data. This is achieved by embedding tags in a specified location in office files without affecting data usage: using custom attributes in the file format specification as the tag information carrier, the tags are written into the file to achieve tag binding.

9. The method according to claim 7, characterized in that, Data binding tags are divided into explicit data security binding tags and implicit data security binding tags. When using explicit data security binding tags, the tag is embedded in the data header and must be removed before using the data. When using implicit data security binding tags, the tag is embedded in a specified location of a specified type of file and does not affect the use of the data.

10. The method according to any one of claims 2-9, characterized in that, A standardized tag format consists of a tag header, a tag body, and an issuer signature. The tag header records the tag's own attributes, including tag type, tag ID, and format version. The tag body includes data attributes, data ID, and / or dataset ID. The data ID is the hash value of the data, representing its uniqueness. Data attributes include data security level, data category, data owner, and data permissions. The issuer signature records the tag service's signature information for the tag, providing integrity and authentication protection for the tag.

Images