CN108108633B - Data file and access method, device and equipment thereof - Google Patents
Data file and access method, device and equipment thereof Download PDFInfo
- Publication number
- CN108108633B CN108108633B CN201711386927.3A CN201711386927A CN108108633B CN 108108633 B CN108108633 B CN 108108633B CN 201711386927 A CN201711386927 A CN 201711386927A CN 108108633 B CN108108633 B CN 108108633B
- Authority
- CN
- China
- Prior art keywords
- data
- file
- access
- metadata
- data file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Abstract
A data file comprising a source file and metadata, wherein: one or more sensitive data is included in the source file; the metadata comprises a metadata table used for recording the storage position of the sensitive data in the source file, and an access strategy generated by combining the access authority of a user to the sensitive data according to the corresponding relation between the metadata table and the storage position of the sensitive data. When different users access the sensitive data in the data file, the access of the users to the sensitive data can be controlled only according to the access strategy in the data file, the data file is not required to be modified such as deleted, controllability and data consistency in the sharing process are guaranteed, and the data file can be effectively controlled according to the access strategy.
Description
Technical Field
The invention belongs to the field of data security, and particularly relates to a data file and an access method, device and equipment thereof.
Background
With the development of mobile internet, intelligent hardware and sensors, the data volume is more and more, the safety of personal data collected by each company cannot be guaranteed, and the events of data leakage, buying and selling are endless, which has caused a huge impact on the normal life of ordinary people. In the age that individuals are gradually digitalized, the state starts legislation control, and the network security law of the people's republic of China issued in the end of 16 years has clear regulations on data acquisition and use. The legislation limits the use of personal data to some extent, but the technology for protecting sensitive data on a data platform still needs to be improved, because when data sharing is performed, the leakage of the sensitive data or inconvenience in data sharing is also caused by the defects of the technology.
In the current cloud Service environment, especially PaaS (Platform-as-a-Service, chinese) or SaaS (Software-as-a-Service, chinese) sensitive data is very common. Such as the customer's name, account information, and various data forms such as documents, service work order descriptions, reports, and the like. During the service provisioning process, sensitive data is easily revealed, if not intentionally made.
In the field of private data protection, recent solutions have only pushed data protection to the file level (for unstructured data) or the data table level (for structured databases). Under such coarse granularity, the consistency of data is difficult to maintain, because the data source platform may directly delete sensitive data and then share the data to other platforms in order to protect the sensitive data, which causes data inconsistency. In order to achieve finer granularity, the existing method is to force the data to be split into a plurality of data tables with different access rights in the database, but the elasticity of data operation is lost. In addition, control of the data may be disabled during its transfer to other platforms (e.g., via mailbox routing).
Disclosure of Invention
In view of this, embodiments of the present invention provide a method, an apparatus, and a device for accessing sensitive data, so as to solve the problem in the prior art that data inconsistency is easily caused, data operation elasticity is lost, or a control right is lost for data, and a right for data acquisition cannot be managed when sensitive data is shared.
A first aspect of an embodiment of the present invention provides a data file, the data file including a source file and metadata, wherein:
one or more sensitive data is included in the source file;
the metadata comprises a metadata table used for recording the storage position of the sensitive data in the source file, and an access strategy generated by combining the access authority of a user to the sensitive data according to the corresponding relation between the metadata table and the storage position of the sensitive data.
With reference to the first aspect, in a first possible implementation manner of the first aspect, the metadata table includes one or more tuples, where an offset of the sensitive data and a length of the sensitive data are recorded in the tuple, and the access policy selects one or more tuples in the metadata according to a permission of a user.
With reference to the first aspect, in a second possible implementation manner of the first aspect, the data file is stored in the file server in an encrypted manner, and an access record of a user accessing the data file is recorded through an access table in the file server.
A second aspect of the embodiments of the present invention provides a method for accessing a data file, where the method for accessing a data file includes:
receiving a reading instruction of file data, and acquiring metadata corresponding to the file data, wherein the metadata is used for marking a storage position and an access strategy of sensitive data in the data file;
searching an access strategy corresponding to a user according to the acquired metadata, wherein the access strategy is generated according to the access authority of the user to the sensitive data;
and controlling the access of the user to the data file according to the access policy.
With reference to the second aspect, in a first possible implementation manner of the second aspect, the step of controlling, according to the access policy, the user's access to the data file includes:
when the access policy allows the user to access the sensitive data in the data file, starting to read the sensitive data in the data file;
and when the access policy does not allow the user to access the sensitive data in the data file, skipping access to the sensitive data.
With reference to the second aspect, in a second possible implementation manner of the second aspect, the method further includes:
when data is written in the data file, comparing the data file after the data is written with the data file before the data is written to obtain newly written data information;
and recording the newly written data information in the metadata corresponding to the data file.
With reference to the second aspect, in a third possible implementation manner of the second aspect, the data file is stored in a central file server, and the method for accessing the data file further includes:
receiving an encrypted access request sent by a terminal, and recording a user of the access request and accessed file information;
and searching a corresponding data file according to the access request, and sending the data file to a terminal.
A third aspect of an embodiment of the present invention provides an apparatus for accessing a data file, where the apparatus for accessing a data file includes:
the metadata acquisition unit is used for receiving a reading instruction of file data and acquiring metadata corresponding to the file data, wherein the metadata is used for marking the storage position and the access strategy of sensitive data in the data file;
the access policy searching unit is used for searching an access policy corresponding to a user according to the acquired metadata, and the access policy is generated according to the access authority of the user to the sensitive data;
and the access control unit is used for controlling the access of the user to the data file according to the access strategy.
A fourth aspect of the embodiments of the present invention provides a data file access device, including a memory, a processor, and a computer program stored in the memory and operable on the processor, wherein the processor implements the steps of the data file access method according to any one of the second aspects when executing the computer program.
A fourth aspect of embodiments of the present invention provides a computer-readable storage medium storing a computer program which, when executed by a processor, implements the steps of the method for accessing a data file according to any one of the second aspects.
Compared with the prior art, the embodiment of the invention has the following beneficial effects: when the data file comprises sensitive data, the storage position of the sensitive data is recorded in metadata in the data file, the metadata also comprises an access strategy generated according to the access authority of a user to the sensitive data, when different users access the sensitive data in the data file, the access of the user to the sensitive data can be controlled only according to the access strategy in the data file, the data file does not need to be modified such as deleted, the controllability and the data consistency in the sharing process are guaranteed, and the data file can be effectively controlled according to the access strategy.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the embodiments or the prior art descriptions will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive exercise.
FIG. 1 is a schematic diagram of a data file structure provided by an embodiment of the present invention;
FIG. 2 is a schematic diagram of a representation of a data file provided by an embodiment of the invention;
FIG. 3 is a schematic flow chart of an implementation of a method for accessing a data file according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of an access device for data files provided by an embodiment of the present invention;
FIG. 5 is a schematic diagram of a data encryption mechanism according to an embodiment of the present invention;
fig. 6 is a schematic diagram of an access device for data files according to an embodiment of the present invention.
Detailed Description
In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular system structures, techniques, etc. in order to provide a thorough understanding of the embodiments of the invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail.
In order to explain the technical means of the present invention, the following description will be given by way of specific examples.
Fig. 1 is a schematic structural diagram of a data file according to an embodiment of the present application, where the data file includes a source file, and the source file may be a file in a different format. For example, the source file may be a WORD file, a POWERPOINT file, a TXT file, or the like. One or more sensitive data may be included in the source file. The sensitive data may be user privacy data in the data file, and the sensitive data may be automatically searched and determined by the system according to a feature keyword of the sensitive data or a type of the data, or may be specified by a user.
In the data file, metadata bound to the source file is further included, and the metadata is used for recording a storage location of sensitive data in the source file, as shown in fig. 1, the metadata includes a metadata table, and the storage location of the sensitive data can be recorded in the metadata table. For example, the storage location of the sensitive data may be represented by an offset of the sensitive data and a length of the sensitive data. The storage address of the starting position of the sensitive data can be determined through the offset of the sensitive data, and the storage address of the ending position of the sensitive data can be determined according to the offset of the sensitive data and the length of the sensitive data. And determining the storage address of the sensitive data according to the storage address of the starting position and the storage address of the ending position.
Each data file may be associated with one or more metadata that records byte locations of sensitive data via a metadata table, thereby enabling byte-level protection of sensitive data. The metadata table may include a plurality of tuples, each tuple may mark a storage address of sensitive data, and the number of tuples may correspond to the number of sensitive data. As shown in fig. 1, the tuple may include an ID number and a tagged memory address. In generating the access policy, the selected sensitive data may be determined by selection of the ID number. As shown in FIG. 1, user 1 corresponds to the access policy generated by tuple 1(ID1) and tuple 3(ID3) in the selected metadata table, and user 2 corresponds to the access policy generated by tuple 1(ID2) and tuple 3(ID3) in the selected metadata table.
The access policy of a plurality of users can generate access policy groups, different access policy groups can be associated with the same source file through different metadata, and when users in the groups access data, the authority is managed through corresponding metadata tables. Therefore, in the process of data sharing, a copy of the file does not need to be generated, and the source file does not need to be modified, so that the controllability of the sharing process and the data consistency are ensured. Fine-grained marking at byte level enables access to be more flexible, dynamic management of different users is achieved, and protection of complex sensitive data embedded in files is more comprehensive.
And recording the offset of sporadic sensitive data, the length of the sensitive data and the access authority of the sensitive data in the data file through the metadata, so that when an application program reads the file, corresponding conversion operation can be generated. When the application program reads the file, the system can inquire whether the user has the access right to the sensitive data according to the access strategy in the metadata about the metadata bound with the source file in the read data file. The authority may be an authority of a system account, an authority of an application program, or an authority corresponding to an account number of the application program. The permissions may also agree in an access policy on the general access permissions any user who receives the data file has.
When it is detected by the access policy that the user has access to sensitive data, the user may be authorized to have access. And when the access policy detects that the user does not have the access right to the sensitive data, skipping the sensitive data, accessing other non-sensitive data after the sensitive data, or accessing other sensitive data with the access right.
When an application writes data to a data file, records in the data written in the data file may be marked in the metadata. Specifically, the location of the written data may be recorded by comparing the data file after the data is written with the data file before the data is written (the data file of the previous version), or the length of the written data may also be recorded, or the storage location of the sensitive data of the written data may also be included. The data consistency can be kept in the data sharing process by recording the record of the written data through the metadata, the resource consumption of sensitive information retrieval and fuzzification is saved, and the system performance is improved to a certain extent.
In addition, the representation form of the sensitive data of the data file in the system is divided into the representation forms of an application layer, a file system layer and a hardware layer, as shown in fig. 2, each layer is respectively described as follows:
in the application layer, the sensitive data can be highlighted in a graphical mode, namely, the sensitive data is highlighted in a graphical interface, so that a user or a manager can know the structure of the data conveniently.
In the file system layer, virtual addresses of a source file and metadata are represented, a data file and the metadata form association in the layer and are converted into file buffer addresses, and the source file and the metadata of the data file are stored in a continuous virtual address and read and written together.
At the hardware level, both the source file and the metadata will be stored as byte data on disk, with no logical association.
Fig. 3 is a schematic flow chart illustrating an implementation process of the access method for a data file according to the embodiment of the present application, which is detailed as follows:
in step S301, a reading instruction of file data is received, and metadata corresponding to the file data is obtained, where the metadata is used to mark a storage location and an access policy of sensitive data in the data file;
specifically, the metadata is substantially the same as the metadata described in fig. 1, and the metadata includes a metadata table marking a storage address of the sensitive data, and an access policy for determining whether a user has an access right to the sensitive data marked by the metadata table.
And the access strategy can be dynamically distributed for different users according to the needs, and the access of the users to the data files is controlled through the access strategy. When the data file is sent or shared, dynamic management of different users can be realized only by dynamically adjusting the metadata in the data file without generating a copy of the file and modifying the source file, and the protection of complex sensitive data embedded in the file is more comprehensive.
In step S302, according to the obtained metadata, an access policy corresponding to the user is searched, where the access policy is generated according to the access authority of the user to the sensitive data;
the access strategy corresponds to the user, and different access strategies can be dynamically generated according to different users, so that the flexible control of the access authority of the data file is realized. In an access policy of a certain user, an ID of sensitive data and authority information may be recorded, and a corresponding relationship between the ID of sensitive data and a storage address of the sensitive data is correspondingly recorded in the metadata table. For example, the storage address of the sensitive data may include an offset address of the sensitive data, a length of the sensitive data, and the like.
The ID of the sensitive data is recorded in the metadata table, so that the storage address of the sensitive data can be found in the metadata table according to the ID in the access policy, and whether the sensitive data stored in the storage address has the access right can be determined.
In step S303, the access of the user to the data file is controlled according to the access policy.
According to the access strategy, when the data file is accessed, if the user is detected to have the access authority to the sensitive data, the authorization for the access to the sensitive data can be obtained, and if the user is detected not to have the access authority to the sensitive data, the sensitive data is skipped.
In addition, when the data file is accessed, data can be written into the data file through an application program. When data is written, the position of the written data can be recorded by the metadata through comparison with the data file of the previous version. Therefore, the consistency of the data can be guaranteed in the sharing process of the data files through the recording of the metadata.
As a preferred implementation manner of the present application, the source files in the data file can also be stored and transmitted in the form of blocks. As shown in fig. 4, the schematic diagram of interaction between the data file and the file system of the terminal when the data file is stored in the central file server is shown, in the diagram, input and output of the data file between the central file server and the file system of the terminal are both implemented in an encrypted manner, so that privacy of access operation of a user can be protected.
As shown in fig. 4, two tables may be stored in the central file server, including an access table and a block table, where the access table records a user ID for accessing a data file, an ID for accessing the data file, and a data block ID in the data file, and the block table records a data file ID, a data block ID in the data file, and a specific source file. The access table can record the access operation of the user, and the block table can quickly search the position of the source file which the user needs to access.
The file system of the central file server and the terminal performs input and output operations in units of blocks, which is beneficial to improving read-write performance and reducing disk fragments.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.
Fig. 5 is a schematic structural diagram of a data file access device according to an embodiment of the present application, where the data file access device includes:
a metadata obtaining unit 501, configured to receive a reading instruction of file data, and obtain metadata corresponding to the file data, where the metadata is used to mark a storage location and an access policy of sensitive data in the data file;
an access policy searching unit 502, configured to search, according to the obtained metadata, an access policy corresponding to a user, where the access policy is generated according to an access right of the user to the sensitive data;
an access control unit 503, configured to control, according to the access policy, the user's access to the data file.
Preferably, the access control unit includes:
the reading subunit is configured to start reading the sensitive data in the data file when the access policy allows the user to access the sensitive data in the data file;
and the skipping subunit is used for skipping the access of the sensitive data when the access policy does not allow the sensitive data in the data file of the user.
Preferably, the apparatus further comprises:
a written data information obtaining unit, configured to, when data is written in the data file, compare the data file after data is written with the data file before data is written, and obtain newly written data information;
and the recording unit is used for recording the newly written data information in the metadata corresponding to the data file.
Preferably, the data file is stored in a central file server, and the data file accessing device further includes:
the request receiving unit is used for receiving the encrypted access request sent by the terminal and recording the user of the access request and the accessed file information;
and the data file sending unit is used for searching a corresponding data file according to the access request and sending the data file to the terminal.
The data file access device shown in fig. 5 corresponds to the data file access method shown in fig. 3.
Fig. 6 is a schematic diagram of an access device for data files according to an embodiment of the present invention. As shown in fig. 6, the access device 6 for data files of this embodiment includes: a processor 60, a memory 61 and a computer program 62, such as an access program for data files, stored in said memory 61 and operable on said processor 60. The processor 60, when executing the computer program 62, implements the steps in the above-described embodiments of the method for accessing data files, such as the steps 301 to 303 shown in fig. 3. Alternatively, the processor 60, when executing the computer program 62, implements the functions of each module/unit in the above-mentioned device embodiments, for example, the functions of the modules 501 to 503 shown in fig. 5.
Illustratively, the computer program 62 may be partitioned into one or more modules/units that are stored in the memory 61 and executed by the processor 60 to implement the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution of the computer program 62 in the access device 6 for the data file. For example, the computer program 62 may be divided into a metadata acquisition unit, an access policy lookup unit, and an access control unit, and each unit specifically functions as follows:
the metadata acquisition unit is used for receiving a reading instruction of file data and acquiring metadata corresponding to the file data, wherein the metadata is used for marking the storage position and the access strategy of sensitive data in the data file;
the access policy searching unit is used for searching an access policy corresponding to a user according to the acquired metadata, and the access policy is generated according to the access authority of the user to the sensitive data;
and the access control unit is used for controlling the access of the user to the data file according to the access strategy.
The access device 6 for the data file may be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. The access device for the data file may include, but is not limited to, a processor 60, and a memory 61. It will be appreciated by those skilled in the art that fig. 6 is merely an example of an access device 6 for data files and does not constitute a limitation of the access device 6 for data files and may include more or fewer components than shown, or some components in combination, or different components, e.g. the access device for data files may also include an input output device, a network access device, a bus, etc.
The Processor 60 may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The memory 61 may be an internal storage unit of the access device 6 for the data files, such as a hard disk or a memory of the access device 6 for the data files. The memory 61 may also be an external storage device of the access device 6 for the data file, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the access device 6 for the data file. Further, the memory 61 may also comprise both an internal storage unit of the access device 6 for the data files and an external storage device. The memory 61 is used for storing the computer programs and other programs and data needed by the access device for the data files. The memory 61 may also be used to temporarily store data that has been output or is to be output.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions. Each functional unit and module in the embodiments may be integrated in one processing unit, or each unit may exist alone physically, or two or more units are integrated in one unit, and the integrated unit may be implemented in a form of hardware, or in a form of software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application. The specific working processes of the units and modules in the system may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and reference may be made to the related descriptions of other embodiments for parts that are not described or illustrated in a certain embodiment.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus/terminal device and method may be implemented in other ways. For example, the above-described embodiments of the apparatus/terminal device are merely illustrative, and for example, the division of the modules or units is only one logical division, and there may be other divisions when actually implemented, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated modules/units, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, all or part of the flow of the method according to the embodiments of the present invention may also be implemented by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method embodiments may be implemented. . Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like. It should be noted that the computer readable medium may contain other components which may be suitably increased or decreased as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media which may not include electrical carrier signals and telecommunications signals in accordance with legislation and patent practice.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not substantially depart from the spirit and scope of the embodiments of the present invention, and are intended to be included within the scope of the present invention.
Claims (10)
1. A data file, comprising a source file and metadata, wherein:
one or more sensitive data is included in the source file; the source file is associated with one or more metadata;
the metadata comprises a metadata table used for recording the storage position of the sensitive data in the source file, and an access strategy generated by combining the access authority of a user on the sensitive data according to the corresponding relation between the metadata table and the storage position of the sensitive data; the storage position is a byte position, the metadata table comprises one or more tuples, and the tuple records the offset of the sensitive data and the length of the sensitive data.
2. The data file of claim 1, wherein the access policy selects one or more tuples in the metadata according to a user's permissions.
3. The data file of claim 1, wherein the data file is stored in the file server in an encrypted manner, and the access record of the user accessing the data file is recorded through an access table in the file server.
4. A method for accessing a data file, wherein the data file comprises a source file and metadata, and wherein the source file comprises one or more sensitive data; the source file is associated with one or more metadata; the data file access method comprises the following steps:
receiving a reading instruction of file data, and acquiring metadata corresponding to the file data, wherein the metadata is used for marking a storage position and an access policy of sensitive data in the data file, the metadata comprises a metadata table, the storage position is a byte position, the metadata table comprises one or more tuples, and the tuple records an offset of the sensitive data and a length of the sensitive data;
searching an access strategy corresponding to a user according to the acquired metadata, wherein the access strategy is generated according to the access authority of the user to the sensitive data;
and controlling the access of the user to the data file according to the access policy.
5. The method of claim 4, wherein the step of controlling the user's access to the data file according to the access policy comprises:
when the access policy allows the user to access the sensitive data in the data file, starting to read the sensitive data in the data file;
and when the access policy does not allow the user to access the sensitive data in the data file, skipping access to the sensitive data.
6. The method of accessing a data file of claim 4, the method further comprising:
when data is written in the data file, comparing the data file after the data is written with the data file before the data is written to obtain newly written data information;
and recording the newly written data information in the metadata corresponding to the data file.
7. The method of claim 4, wherein the data file is stored in a central file server, and the method further comprises:
receiving an encrypted access request sent by a terminal, and recording a user of the access request and accessed file information;
and searching a corresponding data file according to the access request, and sending the data file to a terminal.
8. An apparatus for accessing a data file, wherein the data file comprises a source file and metadata, and wherein the source file comprises one or more sensitive data; the source file is associated with one or more metadata; the data file access device comprises:
the metadata acquisition unit is used for receiving a reading instruction of file data and acquiring metadata corresponding to the file data, wherein the metadata is used for marking a storage position and an access strategy of sensitive data in the data file, the metadata comprises a metadata table, the storage position is a byte position, the metadata table comprises one or more tuples, and the tuples record offset of the sensitive data and length of the sensitive data;
the access policy searching unit is used for searching an access policy corresponding to a user according to the acquired metadata, and the access policy is generated according to the access authority of the user to the sensitive data;
and the access control unit is used for controlling the access of the user to the data file according to the access strategy.
9. An apparatus for accessing data files, comprising a memory, a processor and a computer program stored in said memory and executable on said processor, characterized in that said processor, when executing said computer program, carries out the steps of a method for accessing data files according to any of claims 4 to 7.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the steps of the method for accessing a data file according to any one of claims 4 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711386927.3A CN108108633B (en) | 2017-12-20 | 2017-12-20 | Data file and access method, device and equipment thereof |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711386927.3A CN108108633B (en) | 2017-12-20 | 2017-12-20 | Data file and access method, device and equipment thereof |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108108633A CN108108633A (en) | 2018-06-01 |
| CN108108633B true CN108108633B (en) | 2021-07-13 |
Family
ID=62210636
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711386927.3A Active CN108108633B (en) | 2017-12-20 | 2017-12-20 | Data file and access method, device and equipment thereof |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108108633B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109587132B (en) * | 2018-11-29 | 2021-03-26 | 南京苏宁软件技术有限公司 | Data transmission method and device based on alliance chain |
| CN111400269B (en) * | 2019-01-02 | 2024-04-19 | 中国移动通信有限公司研究院 | IPFS file processing method, node, medium and equipment |
| JP7040467B2 (en) * | 2019-01-11 | 2022-03-23 | 日本電信電話株式会社 | Update device and update method |
| CN110135128A (en) * | 2019-05-22 | 2019-08-16 | 北京明朝万达科技股份有限公司 | A kind of document handling method and device |
| CN111368269B (en) * | 2020-02-29 | 2022-03-29 | 杭州电子科技大学 | Fine-grained access control method based on dense point labeling |
| CN114117149A (en) * | 2021-11-25 | 2022-03-01 | 深圳前海微众银行股份有限公司 | Sensitive word filtering method and device and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1517906A (en) * | 2003-01-14 | 2004-08-04 | 联想(北京)有限公司 | Document system and document management method |
| CN102833346A (en) * | 2012-09-06 | 2012-12-19 | 上海海事大学 | Storage metadata based security protection system and method for cloud sensitive data |
| CN102841902A (en) * | 2011-06-23 | 2012-12-26 | 捷达世软件（深圳）有限公司 | Database data management method and system |
| CN103268455A (en) * | 2013-05-09 | 2013-08-28 | 华为技术有限公司 | Method and device for accessing data |
| CN106469281A (en) * | 2015-08-18 | 2017-03-01 | 华为技术有限公司 | The management method of data file, cloud management point and system in a kind of cloud |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105589733B (en) * | 2015-11-27 | 2018-12-25 | 新华三技术有限公司 | A kind of data processing method and device |
-
2017
- 2017-12-20 CN CN201711386927.3A patent/CN108108633B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1517906A (en) * | 2003-01-14 | 2004-08-04 | 联想(北京)有限公司 | Document system and document management method |
| CN102841902A (en) * | 2011-06-23 | 2012-12-26 | 捷达世软件（深圳）有限公司 | Database data management method and system |
| CN102833346A (en) * | 2012-09-06 | 2012-12-19 | 上海海事大学 | Storage metadata based security protection system and method for cloud sensitive data |
| CN103268455A (en) * | 2013-05-09 | 2013-08-28 | 华为技术有限公司 | Method and device for accessing data |
| CN106469281A (en) * | 2015-08-18 | 2017-03-01 | 华为技术有限公司 | The management method of data file, cloud management point and system in a kind of cloud |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108108633A (en) | 2018-06-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108108633B (en) | Data file and access method, device and equipment thereof | |
| US9262643B2 (en) | Encrypting files within a cloud computing environment | |
| US8977661B2 (en) | System, method and computer readable medium for file management | |
| US9836616B2 (en) | Creating distinct user spaces through user identifiers | |
| US11328081B2 (en) | Consent-based data privacy management system | |
| CN102945355B (en) | Fast Data Encipherment strategy based on sector map is deferred to | |
| EP1946238B1 (en) | Operating system independent data management | |
| US20140019497A1 (en) | Modification of files within a cloud computing environment | |
| CN102855452B (en) | Fast Data Encipherment strategy based on encryption chunk is deferred to | |
| US9003542B1 (en) | Systems and methods for replacing sensitive information stored within non-secure environments with secure references to the same | |
| US9749132B1 (en) | System and method for secure deletion of data | |
| EP2511848A2 (en) | Multiple independent encryption domains | |
| US8863304B1 (en) | Method and apparatus for remediating backup data to control access to sensitive data | |
| US20070011096A1 (en) | Method and apparatus for managing DRM rights object in low-performance storage device | |
| US20090063872A1 (en) | Management method for archive system security | |
| CN109299613B (en) | Database partition authority setting method and terminal equipment | |
| CN111104693A (en) | Android platform software data cracking method, terminal device and storage medium | |
| CN112084536B (en) | Key storage method and device based on blockchain | |
| US8707438B1 (en) | System and method for providing storage for electronic records | |
| CN113297210A (en) | Data processing method and device | |
| KR20140088962A (en) | System and method for storing data in a cloud environment | |
| WO2019119304A1 (en) | Data file, and access method, device and equipment therefor | |
| AU2008344947B2 (en) | System and method for securely storing information | |
| EP4040319B1 (en) | Devices and methods for safe storage of media containing personal data and erasure of stored personal data | |
| KR101041367B1 (en) | Method and apparatus of accessing file or directory in file system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |