Data security method for enterprise digital service platform

Abstract

The application discloses a data security method of an enterprise digital service platform, belongs to the technical field of data security, and aims at cross-tenant unauthorized access and logical isolation failure risks existing in a multi-tenant shared database architecture.The application obtains a business object identification set related to a business request through abstract syntax tree analysis at an API gateway layer, and calculates an unauthorized risk score by comprehensively considering object sensitivity, data convergence and access path abnormality, so that active identification and interception of unauthorized access of batch and paging convergence classes are realized, a data encryption key is dynamically derived according to tenants and fields by taking tenant identification and field identification as parameters through a key derivation function, and the tenant identification and the field identification are taken as additional authentication data to participate in encryption operation, so that the sensitive field is realized in the shared database architecture. The application considers unauthorized identification capability and key management efficiency, and can effectively prevent cross-tenant data leakage.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a data security method for enterprise digital service platforms. Background Technology

[0002] As enterprises accelerate their digital transformation, more and more enterprise service platforms are adopting the Software as a Service (SaaS) model to provide business capabilities to the outside world. In order to reduce resource deployment costs and improve system operation and maintenance efficiency, such platforms generally adopt an architecture pattern of shared database and shared data table structure. That is, the business data of different tenants (enterprise customers) are stored in the same physical database or even the same data table. The ownership of the data is distinguished only by adding a tenant identifier field to each data record. The tenant identifier filter conditions are automatically added to each data query in the business code or data access layer, thereby achieving multi-tenant data isolation at the logical level.

[0003] In terms of access security protection, the industry generally deploys Web application firewalls or single-point identity verification gateways based on token and signature mechanisms at the system entry point to authenticate the identity of the request initiator. Combined with pre-configured interface-level permission rules, such as a whitelist of interfaces that can be accessed by roles, access requests are controlled in a coarse-grained manner. In terms of data encryption protection, some platforms introduce key management systems to centrally encrypt and manage sensitive data such as database connection passwords and static configuration information.

[0004] The existing technical solutions that are similar to this invention mainly include the following two categories. One is a single-point rule authentication scheme based on API gateway. The processing flow of this scheme is as follows: after the gateway receives the access request, it parses the identity credentials carried in the request and verifies whether the user who initiated the request has the role permission to access the target interface. If so, it further compares the tenant identifier of the object carried in the request path parameters with the tenant identifier of the current user. If they match, the request is allowed; otherwise, it is rejected. This scheme has a certain ability to identify unauthorized access at the level of a single record. However, since its judgment logic only compares a single object in a single request, it fails to establish the overall association between the request context and the accessed business object. Therefore, it lacks a unified semantic-level judgment mechanism for the cross-tenant data aggregation behavior implicit in the batch query interface and pagination export interface.

[0005] The second approach is a static field encryption scheme based on a key management system. This scheme consists of an application server, a key management system service, and encrypted data tables. The encryption process is as follows: before writing data to sensitive fields, the application calls the key management system interface to apply for and store a unique key for each tenant. When writing data, the tenant's unique key is used to encrypt the sensitive fields before storing them in the database. When reading data, the key management system is called again to obtain the tenant's unique key for decryption. This scheme achieves cryptographic isolation by distinguishing keys by tenant. However, since it is necessary to generate and persistently store unique keys for a large number of tenants, the overhead of key storage, backup, rotation, and retrieval will increase significantly as the number of tenants expands. Furthermore, in business scenarios involving cross-tenant statistical analysis, it is also necessary to temporarily schedule multiple keys from different tenants for collaborative decryption, which significantly increases the complexity of the system architecture and runtime latency, making it difficult to achieve large-scale deployment in large-scale software-as-a-service scenarios. Therefore, we propose a data security method for enterprise digital service platforms. Summary of the Invention

[0006] The purpose of this invention is to provide a data security method for enterprise digital service platforms.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a data security method for an enterprise digital service platform. This method is deployed in the API gateway layer and object relation mapping persistence layer of the enterprise digital service platform, and includes two independent but coordinated processing processes: a business semantic privilege escalation detection process and a zero-intrusion cryptographic-level multi-tenant isolation process.

[0008] During the business semantic unauthorized access detection process, the gateway intercepts business requests sent by the client, parses the identity credentials of the business request to obtain the tenant identifier and user role of the current access subject, and performs abstract syntax tree parsing on the path parameters, query parameters, and request body of the business request to obtain the set of business object identifiers involved in the business request. It queries the pre-built business object relationship graph to obtain the tenant label of each business object in the set of business object identifiers. The tenant identifier of the current access subject is compared with the tenant label of each business object one by one. If there is a discrepancy, the business request is determined to be a cross-tenant unauthorized access request and is blocked. If they are all consistent, the gateway further calculates the unauthorized access risk score of the business request based on the preset sensitivity level of the data category of the accessed business object, the ratio of the number of business objects hit by the current business request to the preset single access limit corresponding to the user role, and the deviation of the current access subject's cumulative access count within a preset sliding time window from its historical average access frequency. The score is then compared with a preset threshold to determine whether to block or allow the business request.

[0009] In the zero-intrusion cryptographic-level multi-tenant isolation process, the object-relational mapping interceptor is triggered before the business application initiates a data write request and generates a structured query statement. It obtains the tenant identifier to which the data write request belongs, identifies the target field to be encrypted, obtains the master key uniformly managed by the key management system, and calls a hash-based key derivation function with the tenant identifier and the identifier of the target field as derivation parameters. Using the master key as input key material, it calculates in real time the data encryption key corresponding to the tenant and the field. Using this data encryption key as the key, and the concatenation result of the tenant identifier and the identifier of the target field as additional authentication data, it uses an authentication encryption algorithm to encrypt the plaintext of the target field, obtaining ciphertext and authentication tag, and writes it to the shared database. When reading data, the same data encryption key as when writing is re-derived in the same way, and decryption and integrity verification are performed on the ciphertext. Only when the verification passes is the plaintext of the field restored.

[0010] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0011] 1. By introducing a business object relationship graph and a batch operation risk scoring mechanism, this invention enables the system to identify complex logical unauthorized behaviors across requests and batches from the business semantic level. It can proactively identify and intercept unauthorized access behaviors such as batch fetching and pagination aggregation that are difficult to detect by traditional single-point rule authentication schemes at the gateway layer, thus making up for the shortcomings of existing technologies that can only identify unauthorized behaviors at the single record level.

[0012] 2. This invention manages only a small number of master keys through a key management system and uses key derivation functions to dynamically derive data encryption keys at the tenant and field granularities in real time based on tenant and field identifiers. This eliminates the need to generate and persistently store dedicated keys for a massive number of tenants. While achieving cryptographic-level isolation of sensitive fields in a shared database architecture, it avoids the problems of high key management complexity and large cross-tenant collaborative scheduling overhead caused by existing tenant static key storage schemes. Even if the entire database is acquired or internal privilege credentials are leaked, attackers can only obtain ciphertext data that cannot be decrypted, fundamentally avoiding the security risk of full data exposure due to logical isolation failure.

[0013] 3. This invention uses tenant identifiers and field identifiers as additional authentication data to participate in authentication encryption operations, so that the obtained ciphertext is strongly bound to its tenant and field. Even if the ciphertext is misused or copied across tenants or fields, it cannot pass the integrity check, thus providing additional anti-tampering and anti-misuse capabilities for data at the cryptographic level.

[0014] 4. The business semantic privilege escalation detection process and the zero-intrusion cryptographic-level multi-tenant isolation process of this invention are deployed independently in the access control layer and the data storage layer, respectively. The two are independent of each other but work together to form a two-layer collaborative defense system. This ensures that even if an attacker bypasses the access control of the gateway layer and directly obtains the underlying database data, they will still be unable to recover the plaintext data due to the lack of the correctly derived key. This improves the overall data security protection capability of the enterprise digital service platform under the shared database architecture. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the complete two-layer collaborative defense process in an embodiment of the present invention;

[0016] Figure 2 This is a schematic diagram of the ORM persistence layer and zero-intrusion cryptographic isolation in an embodiment of the present invention;

[0017] Figure 3 This is a schematic diagram of the API gateway layer and the business semantic unauthorized detection process in an embodiment of the present invention. Detailed Implementation

[0018] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0019] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0020] In this embodiment, the data security method for an enterprise digital service platform provided by the present invention is deployed on two key layers of an enterprise digital service platform: one is a business semantic privilege escalation detection engine deployed on the API gateway layer, and the other is a transparent encryption and decryption intermediate layer deployed on the object relational mapping persistence layer. The two work together to form two independent and complementary lines of defense: access control and cryptographic isolation.

[0021] In the overall architecture of this system, the top layer consists of the client and front-end applications, which initiate business requests to the platform via a secure transmission protocol. The requests first enter the API gateway layer, which contains an identity authentication module, an abstract syntax tree request parsing module, and a business semantic privilege escalation detection engine. The privilege escalation detection engine connects to a bypass-deployed in-memory database via the network. This in-memory database caches a pre-built business object relationship graph. Requests that pass the detection are forwarded to the backend business service cluster. The business service cluster accesses the persistence layer through an object relationship mapping framework. The persistence layer embeds a custom object relationship mapping interceptor, forming a transparent encryption / decryption middleware layer. This middleware layer connects to the key management system through a secure channel to obtain the master key and maintains a local cache of the master key based on a least recently used strategy. The transparent encryption / decryption middleware layer ultimately reads and writes tenant data tables in the shared database. Sensitive fields in the tables are stored in encrypted form. In addition, both the privilege escalation detection engine and the transparent encryption / decryption middleware layer write critical events to a unified security audit log module for security operations personnel to perform post-event review and policy optimization.

[0022] I. Specific implementation method of business semantic privilege escalation detection process:

[0023] This process is implemented at the API gateway layer. The core is to upgrade the isolated verification method for a single request and a single object in the existing technology to a joint semantic reasoning method that combines the request context and the business object graph.

[0024] In this embodiment, it is assumed that there are two enterprise customers, Tenant A and Tenant B, on a Software as a Service platform. Their order data is stored in the same order data table and they are distinguished only by the tenant identifier field on the order record. When a user account of Tenant A initiates a request to export the order list in pagination, the gateway first intercepts the HTTP request, parses the identity credentials in the request header to obtain the tenant identifier and user role to which the current access subject belongs, and constructs a syntax tree for the request path parameters, query parameters and request body based on abstract syntax tree parsing technology. From this, it extracts all order object identifiers involved in this request to obtain the object identifier set.

[0025] Subsequently, the gateway initiates a query to the business object relationship graph cached in the memory database to obtain the tenant tag to which each order object belongs in the object identifier set, as well as the parent-child or association relationship between the order object and other business objects. The business object relationship graph is constructed with business objects as nodes and the ownership relationship between business objects and tenants and the association relationship between business objects as edges. There are no connecting edges between object nodes belonging to different tenants in the graph, which can intuitively reflect the data ownership boundary between tenants and support the gateway to quickly determine whether a set of objects crosses the tenant boundary through graph query.

[0026] The gateway compares the tenant identifier of the current accessing subject with the tenant label of each order object in the object identifier set. If the tenant label of any order object does not match the tenant identifier of the current accessing subject, the request is directly marked as an unauthorized cross-tenant request and blocked. If all match, batch semantic analysis is further performed on the pagination export interface. Specifically, the gateway counts the number of order objects hit in this request, and combines this with the number of single-accessible objects corresponding to the current user role in the preset policy table, and the historical cumulative number of accesses to the same type of object by the accessing subject within the preset sliding time window, to calculate the unauthorized access risk score of this request using the following formula:

[0027] ;

[0028] in, The overall risk score for this business request is as follows: This is the object sensitivity component, and its value is determined by the preset sensitivity level of the data category to which the order object accessed in this request belongs. The higher the sensitivity level of the data category, the lower the sensitivity level. The larger the value, This is a data aggregation quantity component, representing the ratio of the number of order objects hit in this request to the number of objects that the current user role is allowed to access in a single request. The larger this ratio, the higher the risk of batch fetching inherent in this request. The access path anomaly component represents the degree of deviation of the current access subject's cumulative access count within a preset sliding time window from its historical average access frequency. The greater the deviation, the higher the degree of anomaly of the current access behavior relative to the access subject's historical behavior patterns. , , These are the weight coefficients for the object sensitivity component, the data aggregation volume component, and the access path anomaly component, respectively. The values ​​of the three are pre-calibrated based on historical security events, and the sum of the three is one.

[0029] The gateway will calculate With preset threshold Comparison: If Not less than If the request is deemed to have an unauthorized access risk, including but not limited to batch fetching, pagination aggregation leakage, or abnormal lateral traversal, the gateway will directly intercept the request and return a unified unauthorized access denial response to the client. Simultaneously, it will write key information such as the tenant identifier, user role, object identifier set, and unauthorized access risk score corresponding to this request into the security audit log for review and dynamic policy optimization by security operations personnel. Less than If the request is deemed legitimate, it will be allowed and forwarded to the backend business service for processing.

[0030] In this way, even if an attacker splits multiple cross-tenant data that should be restricted into multiple single-point requests in an attempt to circumvent the authentication scheme based on single-point rules, the unauthorized access risk scoring mechanism provided by this invention can identify the data aggregation unauthorized behavior constituted by these requests as a whole from the dimensions of the cumulative number of hit objects and the degree of abnormality in access frequency. Thus, it can actively intercept complex logical unauthorized behavior at the gateway layer with low latency.

[0031] II. Specific Implementation Method of Zero-Intrusion Cryptographic-Level Multi-Tenant Isolation Process:

[0032] This process is implemented in the object-relational mapping persistence layer. Its core is to achieve cryptographic-level isolated storage by tenant and by sensitive field granularity through real-time dynamic derivation without modifying the upper-layer business code. This includes two parts: write path and read path.

[0033] The specific implementation of the write path is as follows: After the business application initiates a data write request, the custom object relationship mapping interceptor is automatically triggered before the structured query statement is generated. It obtains the tenant identifier of the current request from the thread local variable bound to the current request, and parses the field annotations of the target entity class to identify the target field set marked as sensitive fields. In this embodiment, the customer mobile phone number field in the order data table is used as an example of the target field.

[0034] For each field to be encrypted in the target field set, the object-relational mapping interceptor first checks whether a currently valid master key already exists in the local cache of the master key maintained by the least recently used strategy in the application memory. If the cache is hit, the master key is used directly. If not, a request is sent to the key management system through a secure channel to obtain the currently valid master key, and the master key is written into the local cache. The master key is rotated uniformly by the key management system according to a preset period. Expired or no longer used master keys in the local cache are eliminated according to the least recently used strategy.

[0035] Subsequently, a derived salt value is constructed by concatenating the tenant identifier of the current request with the identifier of the current field. A hash-based key derivation function is then called, using the master key as input key material and the salt value, along with a fixed algorithm and version context identifier, as parameters. The data encryption key specific to this tenant in this field dimension is calculated in real time, and the calculation relationship is shown in the following formula:

[0036] ;

[0037] in, This is the data encryption key derived this time, which corresponds only to a specific tenant and a specific field. The master key obtained from the key management system. The tenant identifier to which the current request belongs. This is an identifier for the field to be encrypted; it can be the field name or the field code. It serves as a fixed algorithm and version context identifier to distinguish different encryption scheme versions and prevent confusion regarding the use of keys;

[0038] The above-derived Using the key, an authentication encryption algorithm is used to encrypt the plaintext field. The operation relationship is shown in the following formula:

[0039] ;

[0040] in, The encrypted ciphertext and authentication label are the result of the encryption. The field-level data encryption key derived above, This is a one-time random number generated for this encryption. The plaintext of the field to be encrypted. For additional authentication data, its value is the concatenation result of the tenant identifier of the current request and the current field identifier. It is used to forcibly bind the ciphertext to its tenant and field, so that the ciphertext cannot pass the integrity check even if it is copied to other contexts.

[0041] The object-relational mapping interceptor concatenates and encodes the random number, ciphertext, and authentication tag, replaces the plaintext parameters at the corresponding field positions in the original structured query statement, and submits the rewritten structured query statement to the shared database for writing.

[0042] The specific implementation of the read path is as follows: When a business application initiates a data query request, the object relational mapping interceptor is automatically triggered before the database result set is returned and before it is mapped to a business entity object. Similarly, it obtains the tenant identifier to which the current request belongs from the thread local variable, and identifies the ciphertext fields in the result set that belong to the target field set. For each ciphertext field, it re-derives the data encryption key that is completely consistent with the one written, in the same way as the write path, using the same master key, the same tenant identifier and the same field identifier. The whole process does not require storing or retrieving any separately saved subkeys.

[0043] The newly derived data encryption key is used to decrypt and verify the obtained ciphertext and authentication tag. If the verification passes, the plaintext of the field is restored and backfilled into the corresponding field of the mapped business entity object for normal use by business logic. If the decryption or integrity verification fails because the ciphertext actually belongs to another tenant, is maliciously tampered with, or is obtained through cross-database unauthorized copying, the current access is determined to be without legal decryption conditions, the current data return is stopped and a security exception is thrown. At the same time, the exception event is written to the security audit log.

[0044] By combining the above-mentioned write and read paths, this invention only requires a limited number of master keys to be managed by the key management system. It does not require generating and persistently storing a dedicated key for each tenant. This enables cryptographically isolated storage at the tenant and field level. Even if the shared database is completely acquired or internal privileged credentials are leaked, attackers can only obtain ciphertext data that cannot be decrypted. This fundamentally avoids the security risk of full data exposure due to logical isolation failure, while keeping cryptographic overhead within an acceptable range for business operations.

[0045] III. Overall Implementation Method of Two-Layer Collaborative Defense:

[0046] In this embodiment, the business semantic overreach detection process and the zero-intrusion cryptographic multi-tenant isolation process are deployed independently in the access control layer and the data storage layer, respectively. Business requests that have passed the business semantic overreach detection process are forwarded to the backend business service. When the backend business service accesses the persistence layer through the object-relational mapping framework, it executes the zero-intrusion cryptographic multi-tenant isolation process to encrypt and decrypt the target field. Together, they form a two-layer collaborative defense system, which ensures that even if an attacker bypasses the access control of the gateway layer and directly obtains the underlying database data, the attacker will still be unable to recover the plaintext data due to the lack of the correct dynamically derived key. This fundamentally avoids the risk of full data exposure caused by logical isolation failure.

[0047] IV. Other implementation methods:

[0048] In another embodiment, during the business semantic privilege escalation detection process, the in-memory database used for storing and querying the business object relationship graph can be replaced with a graph database. By leveraging the graph database's native multi-hop relationship query capability, deep permission graph calculation can be performed on large-scale tenant scenarios with more complex multi-level organizational structures, data inheritance, and authorization links. This is to adapt to application scenarios with deeper business object relationship levels and more complex permission rules. In this embodiment, except for the change in the storage and querying method of the business object relationship graph, the other steps are consistent with the aforementioned embodiment.

[0049] In another embodiment, in the key derivation and encryption algorithm stage, the combination of the hash-based key derivation function and the internationally used cryptographic algorithm in the authentication encryption algorithm can be replaced with a domestic cryptographic algorithm system. That is, a domestic hash algorithm is used as the hash function in the key derivation process, and the authentication encryption working mode of a domestic block cipher algorithm is used to replace the aforementioned authentication encryption algorithm for field-level data encryption and decryption operations. The rest of the overall technical solution, which dynamically derives subkeys in real time based on the master key, tenant identifier, and field identifier, and uses the tenant identifier and field identifier as additional authentication data to participate in authentication encryption, remains unchanged, so as to meet the deployment scenarios with clear requirements for the compliance of domestic cryptographic algorithms.

[0050] It should be noted that the data security method provided by this invention can not only be applied to multi-tenant software-as-a-service scenarios of enterprise digital service platforms, but also extended to scenarios in industrial internet platforms where multiple access enterprises share the same cloud data storage and access interface. This is to prevent unauthorized access and data leakage between different access enterprises, and to provide cryptographic-level protection for sensitive production data in the event of a database attack.

[0051] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A data security method for enterprise digital service platforms, applied to enterprise digital service platforms with deployed API gateway layers, characterized in that: include: The gateway intercepts business requests sent by clients, parses the identity credentials of the business requests to obtain the tenant identifier and user role of the current access subject, performs abstract syntax tree parsing on the path parameters, query parameters, and request body of the business requests to obtain a set of business object identifiers involved in the business requests, queries a pre-built business object relationship graph to obtain the tenant tag of each business object in the set of business object identifiers, compares the tenant identifier of the current access subject with the tenant tag of each business object one by one, if there is a business object whose tenant tag does not match the tenant identifier of the current access subject, then the business request is determined to be a cross-tenant unauthorized request, and the business request is intercepted. If the tenant tags of the business objects are consistent with the tenant identifier of the current access subject, then the unauthorized access risk score of the current business request is calculated based on the preset sensitivity level of the data category to which the business object hit by the current business request belongs, the ratio of the number of business objects hit by the current business request to the preset number of single accesses corresponding to the user role, and the degree of deviation of the current access subject's cumulative access count within the preset sliding time window from its historical average access frequency. The unauthorized access risk score is compared with a preset threshold. If the unauthorized access risk score is not less than the preset threshold, the business request is blocked. If the unauthorized access risk score is less than the preset threshold, the business request is forwarded to the backend business service.

2. The data security method for an enterprise digital service platform according to claim 1, characterized in that, Also includes: When the business request is intercepted, the tenant identifier, user role, business object identifier set, and unauthorized access risk score of the current access subject are written into the security audit log.

3. The data security method for an enterprise digital service platform according to claim 1, characterized in that: The business object relationship graph is constructed with business objects as nodes and the ownership relationship between business objects and tenants and the association relationship between business objects as edges, and is cached in an in-memory database for the gateway to query.

4. The data security method for an enterprise digital service platform according to claim 1, characterized in that: The preset number of accesses per access, the preset sliding time window, and the preset threshold are all pre-calibrated based on historical security events.

5. A zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform, applied to an enterprise digital service platform with an object-relational mapping persistence layer, characterized in that... include: The object-relational mapping (ORM) interceptor is triggered before the data write request initiated by the business application generates a structured query statement. It obtains the tenant identifier to which the data write request belongs, parses the field annotations of the target entity class, identifies the target field to be encrypted, obtains the master key uniformly managed by the key management system, and uses the tenant identifier and the identifier of the target field as derivation parameters to call a hash-based key derivation function. Using the master key as input key material, it calculates the data encryption key corresponding to the tenant identifier and the target field. Using the data encryption key as the key, and the concatenation result of the tenant identifier and the identifier of the target field as additional authentication data, it encrypts the plaintext of the target field using an authentication encryption algorithm to obtain ciphertext and an authentication tag. The ciphertext and authentication tag then replace the structured query statement. The plaintext parameters corresponding to the field positions in the query statement are submitted to the shared database for writing. When a business application initiates a data query request, the object-relational mapping interceptor is triggered before the result set returned by the database is mapped to the business entity object. It obtains the tenant identifier to which the data query request belongs and identifies the ciphertext field belonging to the target field in the result set. Based on the master key, the tenant identifier to which the data query request belongs, and the identifier of the target field, it recalculates the data encryption key that is consistent with the one used during writing. The recalculated data encryption key is used to decrypt and verify the ciphertext and authentication tag corresponding to the ciphertext field. If the verification passes, the plaintext of the field is obtained and backfilled into the mapped business entity object. If the verification fails, the current data return is aborted and a security exception is thrown.

6. The zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform according to claim 5, characterized in that: The master key is maintained in a local cache based on a local caching strategy. When the object-relational mapping interceptor obtains the master key, it first queries the local cache. If a currently valid master key exists in the local cache, it directly uses the master key. If a currently valid master key does not exist in the local cache, it requests the key management system to obtain the currently valid master key and writes it into the local cache.

7. The zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform according to claim 5, characterized in that: The master key is rotated by the key management system at a preset cycle.

8. The zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform according to claim 5, characterized in that: If the integrity check fails, the corresponding security exception event will be written to the security audit log.

9. A data security method for an enterprise digital service platform, characterized in that, The invention includes a data security method for an enterprise digital service platform according to any one of claims 1 to 4, and a zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform according to any one of claims 5 to 8. In this method, a business request forwarded to a backend business service by the business semantic unauthorization detection method is executed to encrypt and decrypt the target field when the backend business service accesses the object relational mapping persistence layer through the object relational mapping framework.

10. A zero-intrusion cryptographic-level multi-tenant isolation method for an enterprise digital service platform according to claim 5, characterized in that: The hash-based key derivation function uses SM3 as the hash function, and the authentication encryption algorithm is the GCM working mode of SM4.

Images