A modular data security assessment method and system supporting multi-standard extensions

Abstract

The application relates to a modular data security evaluation method and system supporting multi-standard expansion, which comprises the following steps: defining a core engine for providing a general basic service process of data security evaluation; defining an evaluation special area access interface specification and designing an evaluation special area module for corresponding encapsulation of evaluation resources of different standards; registering the evaluation special area module to the core engine to establish a special area list; obtaining an evaluation type selected by a user and to-be-evaluated data, matching and loading a corresponding evaluation special area module from the special area list; calling the loaded evaluation special area module by the core engine, combining the general basic service process to perform security risk evaluation on the to-be-evaluated data, and obtaining a corresponding security evaluation result. Compared with the prior art, the application can realize standardization, intelligentization and flexible expandability of data security evaluation, and meet independent requirements of different standards on data confidentiality and security.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a modular data security assessment method and system that supports multiple standard extensions. Background Technology

[0002] In today's digital age, data has become one of the most important assets for enterprises, and its value is increasingly prominent. However, with the explosive growth of data volume and the continuous enrichment of data application scenarios, data security threats are also showing a trend of diversification and complexity. Frequent security incidents such as data breaches, data tampering, and unauthorized access not only cause economic losses to enterprises but also seriously damage their reputation and customer trust. Against this backdrop, establishing a scientific, systematic, and comprehensive data security assessment methodology has become a core task for enterprises to ensure data security. Data security assessment is not only an important means of identifying potential risks but also a necessary measure to meet legal and regulatory compliance requirements, and the foundation for continuously optimizing the data security management system.

[0003] Considering the current data security compliance system's characteristics of multiple parallel standards, regional differences, and industry-specific features, traditional data security assessment solutions suffer from pain points such as single standard adaptation, rigid systems, inability to iterate and expand, and high costs of repeated assessments, making it difficult to balance multi-dimensional compliance requirements with dynamic business changes. To address this, existing technological research aims to achieve multi-standard data security assessment. Currently, the mainstream technical solutions are categorized into: siloed independent systems, monolithic large-scale systems, and configurable systems. Siloed independent systems adopt a one-standard-for-one-system approach. For example, a separate system is developed to meet "data security risk assessment" requirements; another completely independent system is purchased or developed to meet "personal insurance compliance audit" requirements; and another tool or Excel may be used for "ISO27001 certification." However, these systems are isolated, data is not shared, duplicate projects cannot be reused, and user experiences are fragmented, leading to high procurement, development, and maintenance costs for enterprises, and the inability to share assessment data, creating new data silos. A monolithic, large-scale system is a system that incorporates all possible evaluation criteria. Such systems are usually very large, cumbersome, and difficult to maintain. Whenever a new standard or regulation is introduced, the entire system needs to be modified, tested, and released at the code level. It has extremely poor scalability, slow response speed, and is prone to introducing system stability risks due to frequent changes. Configuration-based systems offer some configuration options, but they are usually limited to minor adjustments to the text of the evaluation items. They cannot deeply customize and extend the core logic of the entire evaluation model (such as the structure of evaluation items, quantitative calculation rules, and report templates), and cannot truly adapt to different evaluation standards with huge differences.

[0004] In summary, existing technologies are unable to effectively adapt to different evaluation standards simultaneously, cannot quickly respond to diverse needs, and are not conducive to conducting efficient and stable data security assessments. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the existing technology by providing a modular data security assessment method and system that supports multiple standard extensions. This method and system can achieve standardization, intelligence, and flexible scalability of data security assessment, and meet the independent requirements of different standards for data confidentiality and security.

[0006] The objective of this invention can be achieved through the following technical solution: a modular data security assessment method supporting multi-standard extensions, comprising the following steps: S1. Define the core engine to provide general basic service processes for data security assessment; S2. Define the access interface specifications for the evaluation zone and design the evaluation zone module to encapsulate evaluation resources for different standards. S3. Register the evaluation zone module to the core engine and create a zone list; S4. Obtain the evaluation type selected by the user and the data to be evaluated, and match and load the corresponding evaluation zone module from the zone list; S5. The core engine calls the loaded assessment zone module and combines it with the general basic service process to conduct a security risk assessment on the data to be assessed, and obtain the corresponding security assessment results.

[0007] Furthermore, the general basic service process in S1 includes user identity authentication and permission management, evaluation task creation and distribution, data persistent storage and retrieval, evaluation item quantitative calculation, and evaluation report generation.

[0008] Furthermore, the process of S2 includes: S21. Define the access interface specification for the evaluation zone, specifying the metadata information that the evaluation zone module must provide and the functions that must be implemented, as the communication protocol between the core engine and the evaluation zone module. S22. Based on the access interface specification of the evaluation zone, independently designed evaluation zone modules adapted to different standards are provided. Each evaluation zone module encapsulates an evaluation item library, a quantitative rule library, and a report template library corresponding to its respective standard.

[0009] Furthermore, the metadata information in S21 includes the evaluation zone code, name, version number, and content description; The functions include retrieving a list of assessment items, retrieving risk calculation formulas, and retrieving report templates.

[0010] Furthermore, the evaluation item library in S22 contains multiple evaluation items and corresponding evaluation requirements; The quantitative rule base contains quantitative risk calculation formulas and judgment rule descriptions; The report template library contains report styles and content structures.

[0011] Furthermore, the process of S4 includes: The user submits an evaluation request, which includes a token and the selected evaluation type. The token is validated for validity, and the user is verified to have permission to create evaluation tasks. If the verification is successful, the evaluation zone module corresponding to the evaluation type is found from the zone list.

[0012] Furthermore, the process of S5 includes: S51: The core engine receives the data to be evaluated submitted by the user, verifies the legality of the data to be evaluated, generates an evaluation task number after the verification is successful, and distributes the evaluation task to the execution node. S52. The execution node calls the loaded assessment zone module to obtain the corresponding assessment resources. First, it maps the data to be assessed to the assessment items. According to the assessment requirements, judgment rules and quantitative risk calculation formula defined by the assessment zone module, it calculates the score of each assessment item in turn. Combined with the weight of the assessment item, it obtains the assessment calculation result and stores it. The assessment calculation result is filled into the report template to generate an assessment report and stores it.

[0013] A modular data security assessment system supporting multi-standard extensions includes a presentation layer, a core engine layer, an assessment zone layer, and a data storage layer. The presentation layer and the assessment zone layer are respectively connected to the core engine layer, and the core engine layer and the assessment zone layer are respectively connected to the data storage layer. The presentation layer is used to provide a user interface to receive user input data information. The core engine layer is used to execute general basic service processes, including: User and permission management service, responsible for user login, authentication and permission control; The workflow engine service is responsible for driving the general process of "assessment preparation -> information research -> risk identification -> comprehensive analysis -> assessment summary"; The data persistence service provides a unified data access API (Application Programming Interface) and is responsible for data isolation and routing. The quantization calculation service provides a standard computing environment to execute quantization rules obtained from the evaluation zone layer; The report generation service generates standardized reports based on templates and data. The assessment zone layer is used to provide assessment resources corresponding to different standards, including assessment items, quantitative rules, and report templates; The data storage layer is used to store general shared data as well as independent data for specific zones.

[0014] Furthermore, the evaluation zone layer includes multiple evaluation zone modules that conform to standard interface specifications, and these multiple evaluation zone modules are independent of each other.

[0015] Furthermore, the data storage layer is equipped with a core shared database and multiple independent databases. The core shared database is interconnected with the core engine layer and is used to store shared data of the evaluation zone layer, including user tables, organizational structure tables, and operation log tables. The multiple independent databases are respectively connected to the evaluation modules of the evaluation zone layer, and are used to store the evaluation process data and evaluation result data corresponding to the evaluation zone modules.

[0016] Compared with the prior art, the present invention has the following advantages: This invention defines a core engine for providing general basic service processes and an access interface specification for evaluation zones. It also designs evaluation zone modules to encapsulate standard evaluation resources. A zone list is established by registering these modules with the core engine. Subsequently, the system can directly match and load the corresponding evaluation zone module from the list based on the user-selected evaluation type. Combined with the general basic service processes, a security risk assessment is performed on the user-submitted data to obtain the corresponding security assessment results. This loosely coupled modular architecture between the core engine and evaluation zone modules completely separates the general basic functions of the evaluation process from the business logic of specific evaluation standards, both physically and logically. This ensures the core engine remains highly stable, while changes in business functions are confined to independent evaluation zone modules. This significantly improves the system's maintainability, scalability, and stability. The integration of new standards will not affect the operation of the core engine, enabling rapid response to diverse evaluation needs while ensuring the stability and efficiency of core general functions.

[0017] This invention defines a special zone access interface specification, which defines the "protocol" for communication between the core engine and any evaluation zone module. It clearly stipulates what metadata information a compliant zone module must provide (including the zone's unique code, name, version number, and description), and what core functions it must implement (e.g., obtaining a list of evaluation items, obtaining the risk calculation formula specific to the evaluation zone, and obtaining a report template). By defining a strict interface contract, any third-party developed evaluation zone module that conforms to this specification can be recognized, loaded, and called by the core engine, achieving "plug and play" evaluation functionality. It can support the combination and expansion of different evaluation standards, greatly reducing the complexity and cost of functional expansion.

[0018] This invention directly registers the designed evaluation zone module into the core engine. Subsequently, the core engine can dynamically load the corresponding evaluation zone module according to the evaluation type selected by the user. When a new evaluation standard is added, only the corresponding evaluation zone module needs to be developed and designed, without modifying the core engine code, which greatly shortens the launch cycle of the new standard evaluation business. In addition, the general capabilities of the core engine can be reused by all evaluation zone modules, avoiding redundant development and having the advantage of high reusability. This invention separates general capabilities from business rules, and the core engine and evaluation zone modules are developed, tested and deployed independently, which improves maintainability.

[0019] This invention adopts a "core shared database + specialized sub-databases" data storage model in the data storage layer of the modular data security assessment system. The core shared database stores shared data of the assessment sub-database, including user tables, organizational structure tables, and operation log tables. Multiple independent databases store assessment process data and assessment result data corresponding to the assessment sub-modules. This not only ensures unified management and reuse of basic data such as user information and avoids data redundancy, but also ensures strict isolation of different assessment business data, meets the independent requirements of different compliance standards for data confidentiality and security, and simplifies database maintenance and backup strategies. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram illustrating the application process of an example. Figure 3 This is a schematic diagram of the system architecture for an example. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0022] Example like Figure 1 As shown, a modular data security assessment method supporting multi-standard extensions includes the following steps: S1. Define the core engine to provide general basic service processes for data security assessment; S2. Define the access interface specifications for the evaluation zone and design the evaluation zone module to encapsulate evaluation resources for different standards. S3. Register the evaluation zone module to the core engine and create a zone list; S4. Obtain the evaluation type selected by the user and the data to be evaluated, and match and load the corresponding evaluation zone module from the zone list; S5. The core engine calls the loaded assessment zone module and combines it with the general basic service process to conduct a security risk assessment on the data to be assessed, and obtain the corresponding security assessment results.

[0023] This embodiment applies the above-described solution, such as Figure 2 As shown, the main processes are as follows: (1) Define the core engine's general services. First, design and implement a core engine that is independent of specific evaluation standards. This core engine provides various general basic services required for the evaluation process, including but not limited to: user authentication and permission management, evaluation task creation and distribution processes, persistent data storage and retrieval, general quantitative calculation components (which can be called by evaluation zone rules), report generation and rendering services, etc. This core engine is the cornerstone and scheduling center of the entire system, providing basic capabilities common to all evaluation scenarios.

[0024] Among them, user identity authentication and access management are used to uniformly manage the identity verification, role assignment and access control of all users, ensuring that different users can only access the evaluation resources and perform corresponding operations within their authorized scope; The creation and distribution of assessment tasks are used to uniformly manage the entire lifecycle of assessment tasks, including task creation, status tracking, task distribution, and execution scheduling. Persistent data storage and retrieval are used to provide unified data storage and access services, isolating upper-layer business from the underlying storage medium; The quantitative calculation component provides a general calculation engine to quantitatively score assessment items based on the assessment rules and risk calculation formulas defined in the assessment zone module. The report generation and rendering process automatically generates a standardized assessment report based on the assessment calculation results and the report template defined in the assessment zone module.

[0025] In addition, in practical applications, a zone management module can be set up in the core engine to manage all registered evaluation zones (such as enabling, disabling, updating versions, and monitoring running status), and to realize the registration, loading, uninstallation, and lifecycle management of evaluation zone modules.

[0026] (2) Define the access interface specification for the assessment zone. Develop a unified and standard access interface (API) specification for the assessment zone. This specification defines the "protocol" for communication between the core engine and any assessment zone module. It clearly stipulates what metadata information a compliant assessment zone module must provide (such as the zone's unique code, name, version number, and description), and what core methods it must implement (e.g., getAssessmentItemList() to retrieve the list of assessment items, getCalculationRule() to retrieve the zone-specific risk calculation formula, and getReportTemplate() to retrieve the report template). This is key to achieving "plug and play," enabling the assessment zone module to function as a pluggable "plugin" capable of encapsulating assessment rules, assessment items, and assessment resources from different industries and standards.

[0027] It should be noted that in practical applications, the above interface can be implemented as a local function call (such as for monolithic applications) or a remote API call (such as for microservice architecture). This replacement of the communication method is an equivalent implementation of the present invention. As long as the contract of the interface definition remains unchanged, its core "loose coupling" idea and technical effect remain unchanged.

[0028] (3) Development and Design of Assessment Zone Modules. Based on the defined interface specifications, independently develop assessment zone modules for various standards. For example, develop a "Data Security Risk Assessment Zone," which encapsulates the 401 assessment items and their weights from the GB / T 45577-2025 standard; develop a "Personal Information Protection Compliance Audit Zone," which encapsulates all assessment points and case rules related to the Personal Information Protection Law. Each assessment zone module is an independent functional unit, highly cohesive and isolated from each other.

[0029] (4) Register and deploy the evaluation zone module. Register the developed evaluation zone module (such as a compiled JAR package, DLL file, or Python module) into the core engine. Registration can be done by deploying the file to a specified directory for automatic scanning and discovery by the core engine; or by manually uploading and registering it through the management interface. After successful registration, the core engine will be aware of the existence of the evaluation zone.

[0030] (5) User selects assessment type. The user submits an assessment request through the unified interface on the system front end. The core engine first performs user identity authentication and permission verification, and then searches for the assessment zone module corresponding to the user's assessment type from the zone list.

[0031] (6) Dynamically loading evaluation modules. The core engine dynamically loads the corresponding evaluation module (such as pip_audit.module) based on the evaluation type selected by the user to obtain the corresponding evaluation resources. This process is dynamic and does not require a system restart.

[0032] (7) Invoking the core engine to execute the process. The core engine begins driving the standard evaluation process. However, it does not handle specific business logic; instead, at each point requiring a business decision, it calls the interfaces provided by the loaded evaluation zone modules to obtain specific resources. For example: When it is necessary to display evaluation items, call the getAssessmentItemList() interface of the special zone.

[0033] When it is necessary to calculate the risk score, call the getCalculationRule() interface of the special zone to obtain the formula, and then substitute it into the general calculation service for calculation.

[0034] When a report needs to be generated, the getReportTemplate() interface of the special zone is called to obtain the template, which is then used in the general report service for rendering.

[0035] In this way, a common core process can achieve the goal of executing multiple different evaluation standards by dynamically calling different evaluation zone modules.

[0036] Based on the above method and process, a system is built as follows: Figure 3 The system architecture shown includes a presentation layer, a core engine layer, an evaluation zone layer, and a data storage layer. The presentation layer and the evaluation zone layer are connected to the core engine layer, and the core engine layer and the evaluation zone layer are connected to the data storage layer. Specifically: (1) Presentation layer (unified user interface): provides users with a single interaction entry point. Users do not need to care which evaluation zone is working in the background, and all operation experiences are consistent.

[0037] (2) Core Engine Layer: The brain and central nervous system of this system, containing a series of general and reusable microservices: User and Access Management Service: Responsible for user login, authentication, and access control for all zones.

[0038] Workflow Engine Service: Responsible for driving the general process of "assessment preparation -> information research -> risk identification -> comprehensive analysis -> assessment summary".

[0039] Data persistence service: Provides a unified data access API for all assessment zones and is responsible for data isolation and routing.

[0040] Quantitative Calculation Service: Provides a standard computing environment to execute calculation rules obtained from the evaluation zone.

[0041] Report generation service: Generate standardized reports based on templates and data.

[0042] (3) Assessment Zone Layer: The limbs and skill set of this system. It consists of multiple zone modules that conform to standard interface specifications. Each assessment zone module is independent and contains three core parts: Assessment Item Library: The assessment item system unique to this standard.

[0043] Business rule base: The standard's unique quantitative calculation logic and judgment rules.

[0044] Report template library: Report styles and content structures specific to this standard.

[0045] (4) Data storage layer: A database sharding design is adopted to achieve data isolation and security.

[0046] Core shared database: Stores data shared by all zones, such as user tables, organizational structure tables, and operation log tables.

[0047] Independent databases for each zone: The evaluation process data and results data for each zone are stored in physically or logically independent databases (such as different schemas or different database instances), ensuring that the data of different evaluation businesses are isolated from each other and do not interfere with each other.

[0048] The data flow and interaction process of the above system include: (1) User requests enter the core engine from the presentation layer.

[0049] (2) The core engine determines which evaluation zone (such as the individual protection zone) should handle the request.

[0050] (3) The core engine calls the evaluation zone module through the standard interface to obtain business data (such as "Give me the evaluation item list").

[0051] (4) The evaluation zone module returns business data to the core engine.

[0052] (5) The core engine calls its own general services (such as data persistence services) to process these data, and according to the data routing rules, stores the proprietary data into the corresponding dedicated independent database and the general data into the core shared database.

[0053] (6) The core engine returns the evaluation results to the presentation layer.

[0054] In summary, this solution, through its decoupled architecture of the core engine and plug-in evaluation zone modules, achieves a qualitative improvement in multiple dimensions, including system scalability, development efficiency, operational stability, data consistency, and business adaptability. It completely solves the problems of traditional evaluation systems, such as "difficult standard adaptation, slow business expansion, excessive repetitive development, and serious data silos."

Claims

1. A modular data security assessment method supporting multi-standard extensions, characterized in that, Includes the following steps: S1. Define the core engine to provide general basic service processes for data security assessment; S2. Define the access interface specifications for the evaluation zone and design the evaluation zone module to encapsulate evaluation resources for different standards. S3. Register the evaluation zone module to the core engine and create a zone list; S4. Obtain the evaluation type selected by the user and the data to be evaluated, and match and load the corresponding evaluation zone module from the zone list; S5. The core engine calls the loaded assessment zone module and combines it with the general basic service process to conduct a security risk assessment on the data to be assessed, and obtain the corresponding security assessment results.

2. The modular data security assessment method supporting multi-standard extensions according to claim 1, characterized in that, The general basic service process in S1 includes user authentication and permission management, evaluation task creation and distribution, persistent data storage and retrieval, quantitative calculation of evaluation items, and evaluation report generation.

3. The modular data security assessment method supporting multi-standard extensions according to claim 2, characterized in that, The process S2 includes: S21. Define the access interface specification for the evaluation zone, specifying the metadata information that the evaluation zone module must provide and the functions that must be implemented, as the communication protocol between the core engine and the evaluation zone module. S22. Based on the access interface specification of the evaluation zone, independently designed evaluation zone modules adapted to different standards are provided. Each evaluation zone module encapsulates an evaluation item library, a quantitative rule library, and a report template library corresponding to its respective standard.

4. The modular data security assessment method supporting multi-standard extensions according to claim 3, characterized in that, The metadata information in S21 includes the evaluation zone code, name, version number, and content description; The functions include retrieving a list of assessment items, retrieving risk calculation formulas, and retrieving report templates.

5. A modular data security assessment method supporting multi-standard extensions according to claim 4, characterized in that, The evaluation item library in S22 contains multiple evaluation items and corresponding evaluation requirements; The quantitative rule base contains quantitative risk calculation formulas and judgment rule descriptions; The report template library contains report styles and content structures.

6. A modular data security assessment method supporting multi-standard extensions according to claim 5, characterized in that, The process in S4 includes: The user submits an evaluation request, which includes a token and the selected evaluation type. The token is validated for validity, and the user is verified to have permission to create evaluation tasks. If the verification is successful, the evaluation zone module corresponding to the evaluation type is found from the zone list.

7. A modular data security assessment method supporting multi-standard extensions as described in claim 6, characterized in that, The process of S5 includes: S51: The core engine receives the data to be evaluated submitted by the user, verifies the legality of the data to be evaluated, generates an evaluation task number after the verification is successful, and distributes the evaluation task to the execution node. S52. The execution node calls the loaded assessment zone module to obtain the corresponding assessment resources. First, it maps the data to be assessed to the assessment items. According to the assessment requirements, judgment rules and quantitative risk calculation formula defined by the assessment zone module, it calculates the score of each assessment item in turn. Combined with the weight of the assessment item, it obtains the assessment calculation result and stores it. The assessment calculation result is filled into the report template to generate an assessment report and stores it.

8. A modular data security assessment system supporting multi-standard extensions, characterized in that, It includes a presentation layer, a core engine layer, an evaluation zone layer, and a data storage layer. The presentation layer and the evaluation zone layer are respectively connected to the core engine layer, and the core engine layer and the evaluation zone layer are respectively connected to the data storage layer. The presentation layer is used to provide a user interface to receive user input data information. The core engine layer is used to execute general basic service processes, including: User and permission management service, responsible for user login, authentication and permission control; The workflow engine service is responsible for driving the general process of "assessment preparation -> information research -> risk identification -> comprehensive analysis -> assessment summary"; The data persistence service provides a unified data access API and is responsible for data isolation and routing. The quantization calculation service provides a standard computing environment to execute quantization rules obtained from the evaluation zone layer; The report generation service generates standardized reports based on templates and data. The assessment zone layer is used to provide assessment resources corresponding to different standards, including assessment items, quantitative rules, and report templates; The data storage layer is used to store general shared data as well as independent data for specific zones.

9. A modular data security assessment system supporting multi-standard extensions according to claim 8, characterized in that, The evaluation zone layer includes multiple evaluation zone modules that conform to standard interface specifications, and these modules are independent of each other.

10. A modular data security assessment system supporting multi-standard extensions according to claim 9, characterized in that, The data storage layer is equipped with a core shared database and multiple independent databases. The core shared database is interconnected with the core engine layer and is used to store shared data of the evaluation zone layer, including user tables, organizational structure tables, and operation log tables. The multiple independent databases are respectively connected to the evaluation modules of the evaluation zone layer, and are used to store the evaluation process data and evaluation result data corresponding to the evaluation zone modules.

Images