CN113591119A - Cross-domain identification analysis node data privacy protection and safety sharing method and system - Google Patents
Cross-domain identification analysis node data privacy protection and safety sharing method and system Download PDFInfo
- Publication number
- CN113591119A CN113591119A CN202110907384.5A CN202110907384A CN113591119A CN 113591119 A CN113591119 A CN 113591119A CN 202110907384 A CN202110907384 A CN 202110907384A CN 113591119 A CN113591119 A CN 113591119A
- Authority
- CN
- China
- Prior art keywords
- data
- desensitization
- node
- encryption
- processed
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/172—Caching, prefetching or hoarding of files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/176—Support for shared access to files; File sharing support
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Abstract
The invention relates to a cross-domain identification analysis node data privacy protection and safety sharing method and system. The method comprises the steps of carrying out classified division on the to-be-processed data generated by the enterprise nodes; verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; acquiring a corresponding encryption algorithm or desensitization algorithm according to the division result and the data request; encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data into a corresponding database; when a request for data query is obtained, the identification analysis system directly obtains data from a corresponding database in a node encryption mode, the obtained data are transmitted to a node front-end module of the enterprise node, and the node front-end module decrypts the obtained data and transmits the decrypted data to the enterprise node. The invention can improve the data privacy protection and the sharing degree, thereby saving the development cost and the operation cost of the whole industry.
Description
Technical Field
The invention relates to the field of industrial internet identification analysis data security, in particular to a cross-domain identification analysis node data privacy protection and security sharing method and system.
Background
The industrial scale of the industrial internet is trillion-level scale, and the industrial internet becomes a support for national economic development. In recent years, the industrial internet industry is developed in a blowout manner, but the security technology of various enterprises is not perfect, and the industrial internet identification data has security risks such as illegal breaking, unauthorized access, privacy disclosure and the like. Sensitive data and private data are used as core assets of enterprises, and huge economic loss can be brought by data leakage.
The traditional solution is to set up network security level protection by means of firewall, intrusion detection and the like, the network security level protection means has high requirements on network security environment, and the data security condition is set up on the network level security, so that the high-level data security protection requirements cannot be met. The novel data protection mode is realized by a data encryption and decryption technology and a data desensitization technology, wherein the encryption technology is used for encryption when data are stored and stored in a warehouse, and the data are decrypted when the data are read. When desensitization data is needed, the desensitization is returned after decryption. The data encryption and decryption service and the data desensitization service and the identification analysis service module are in a set of application program, the mode has high coupling, and in the process of the industrial internet identification analysis service, the data encryption and decryption service is very frequently called under the condition of large data interaction generated by high network flow, and the service concurrency is easy to encounter bottlenecks and difficult to expand, so that the encryption and decryption service is slow, and the overall service quality is influenced.
The industrial internet identification analysis provides network service for nationwide industrial manufacturing enterprises, network connection and data interaction are performed on different enterprise informatization systems, in-factory identification systems, factory identification acquisition equipment and the like, and the related industrial data is huge and has a higher level of security. Therefore, the industrial internet identification analysis system protects important, sensitive and private identification data, a robust identification analysis node access control mechanism is established, and confidentiality and integrity of the data are ensured, so that the industrial internet identification analysis system can provide safe and reliable identification analysis service.
The product tracing system based on industrial internet identification analysis is disclosed. The system comprises an application layer, a product identifier analysis traceability application terminal, a traceability system server, a distributed storage server, an identifier analysis secondary node service platform, a product traceability management platform, a traceability module, a channel conflict prevention module, an anti-counterfeiting module, a product upstream module, a product downstream module and a production enterprise management module. The product tracing system based on the industrial internet identification analysis is provided. The product tracing system and the product tracing method based on the industrial internet identification analysis change the original mode, and store the tracing and positioning information of each stage in the database of each enterprise to form a distributed data storage mode; the information is inquired through the identification analysis system, so that the authenticity and authority of the information are effectively improved.
However, the industrial internet industry has reached the scale of trillions, and the volume of enterprise data for identification resolution is also enormous. In the industrial internet identification analysis data protection, an encryption and decryption method is directly used, generally, a segmented encryption mode, a confusion encryption mode and other modes are adopted to carry out integral encryption on data, in this mode, when the data volume is interacted much, the calling frequency of the encryption method is continuously increased, and once the throughput exceeds a critical value, the problems of time overtime, service error report and the like can be caused. The encryption cost is too high without hierarchical protection. Meanwhile, in the encryption process of the existing scheme, the obtained data is encrypted in full, and some public non-sensitive data do not relate to protected data and are not distinguished, so that important data and common data are protected in the same way, the data protection cost is increased, and the system response speed is slowed down.
The problems of high encryption cost, large data interaction amount, low data privacy protection and low sharing degree exist in the existing industrial internet identification analysis identification data storage and data use process.
Disclosure of Invention
The invention aims to provide a cross-domain identification analysis node data privacy protection and safety sharing method and system, which can improve the data privacy protection and sharing degree and further save the development cost and the operation cost of the whole industry.
In order to achieve the purpose, the invention provides the following scheme:
a cross-domain identification parsing node data privacy protection and secure sharing method comprises the following steps:
carrying out classified division on the private data of the data to be processed generated by the enterprise nodes; dividing the result into 1-level privacy data, 2-level privacy data, 3-level privacy data, 4-level privacy data and 5-level privacy data; the level 1 private data is public data information; the 2-level privacy data is data which can be checked or simply encrypted and displayed in an enterprise or a company; the 3-level privacy data is encrypted and stored, and meanwhile, a plaintext is also stored, and data displayed in a desensitized manner is stored; the 4-level privacy data is enterprise privacy data which is subjected to hard encryption and desensitization preservation and is used for storing plaintext data; the 5-level privacy data is enterprise privacy data which is irreversibly encrypted and desensitized and has no plaintext data;
acquiring a data request initiated by an enterprise node to a node front-end module; the data request includes: a data encryption request or a data desensitization request;
verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the encrypted data includes: desensitizing the data and ciphertext data;
acquiring a corresponding encryption algorithm or desensitization algorithm according to a division result of the data to be processed and a data request; encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data to a corresponding database; the database includes: an encryption database and a desensitization database;
when a request for data query is obtained, the identification analysis system directly obtains data from a corresponding database in a node encryption mode, the obtained data are transmitted to a node front-end module of the enterprise node, and the node front-end module decrypts the obtained data and transmits the decrypted data to the enterprise node.
Optionally, the verifying the validity of the data to be processed, and encrypting the data to be processed when the data to be processed is legal, and then the method further includes:
and establishing an encryption database and a desensitization database according to the ciphertext attribute of the encrypted data.
Optionally, the corresponding encryption algorithm or desensitization algorithm is obtained according to the division result of the data to be processed; and encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data into a corresponding database, wherein the method specifically comprises the following steps:
when the encrypted data is desensitized data, the data is combed according to the parameter rules, the data types are judged through the regular expressions, the parameter values and the parameter types, and the desensitization of different data types and desensitization requirements is realized according to the parameter classification.
Optionally, the corresponding encryption algorithm or desensitization algorithm is obtained according to the division result of the data to be processed; and encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data into a corresponding database, wherein the method specifically comprises the following steps:
when the encrypted data is desensitized data, the industrial internet identification analysis system receives a request desensitization request through encryption and decryption and desensitization service, and verifies whether a certificate is legal or not; after the verification is passed, acquiring an encryption and decryption secret key according to the desensitization data, and acquiring decrypted desensitization data in the request according to the secret key and a data decryption method;
analyzing the decrypted desensitization data, and verifying data rules by using a regular expression;
when the verification is passed, distinguishing field attributes in the entity according to a data entity model transmitted by the enterprise node, configuring a fuzzy algorithm for data of each field attribute according to a dynamic desensitization rule in a default mode, and ensuring that sensitive information is not leaked by specifying the desensitization rule and different data access strategies;
and calling a corresponding desensitization algorithm to operate the desensitization field data in the decrypted desensitization data according to the data desensitization requirement of each desensitization field and the corresponding desensitization rule, so as to obtain desensitization field data and realize data desensitization.
A cross-domain identification analysis node data privacy protection and safe sharing system is used for realizing the cross-domain identification analysis node data privacy protection and safe sharing method, and comprises the following steps:
the enterprise node is used for generating data to be processed; the data to be processed comprises: encrypting and decrypting data and desensitizing data;
the node front-end module is used for data encryption uploading, encrypted data acquisition, desensitization data acquisition and data decryption;
the privacy confidentiality module is used for verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the system is also used for reading a private key of an asymmetric encryption algorithm according to the visiting enterprise node identification, calling an interface of encryption and decryption and desensitization service, and decrypting ciphertext data;
the encryption, decryption and desensitization module is used for encrypting data in an asymmetric encryption mode of a cryptographic technology and realizing network link data transmission between the node front-end module and the privacy protection module in a ciphertext data form; the method is also used for carrying out rule verification according to data model attribute classification when data needs desensitization, and then calling a corresponding desensitization algorithm to realize rapid data desensitization;
a desensitization database for storing desensitized data;
and the encryption database is used for storing the encrypted data.
Optionally, the node front-end module includes: the data encryption system comprises a data encryption uploading interface, an encrypted data acquisition interface, a desensitization data acquisition interface and a data decryption interface.
Optionally, the node front module further includes: a node privacy data classification model based on service attributes;
and the node privacy data grading model based on the service attributes is used for grading and dividing the privacy data of the to-be-processed data generated by the enterprise nodes.
According to the specific embodiment provided by the invention, the invention discloses the following technical effects:
according to the cross-domain identification analysis node data privacy protection and safety sharing method and system, intelligent association of different main, different place and different type information is achieved through industrial internet identification analysis, and support is provided for data safety sharing and full life cycle management. Meanwhile, the decryption method calling frequency of the hardware encryption machine is reduced through a data security sharing mode, the desensitization data reading flow is shortened, the response time is shortened, and the service resources are saved. Therefore, the technical risks that the industrial internet data are illegally accessed and the privacy is revealed are greatly reduced, the repeated development of the industrial internet industry on various common access control and authority management services can be reduced, and the development cost and the operation cost of the whole industry are saved. The data storage is divided into ciphertext database and desensitization database double-database storage, and the encryption and decryption service is separated from the main service of industrial internet identification analysis, so that the encryption and decryption service can be freely and transversely expanded according to the traffic.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings without inventive exercise.
Fig. 1 is a schematic flowchart of a cross-domain identifier resolution node data privacy protection and secure sharing method provided in the present invention;
fig. 2 is a timing diagram of a cross-domain identifier resolution node data privacy protection and secure sharing method provided in the present invention;
FIG. 3 is a schematic diagram of the overall scheme;
figure 4 is a data desensitization flow chart.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The invention aims to provide a cross-domain identification analysis node data privacy protection and safety sharing method and system, which can improve the data privacy protection and sharing degree and further save the development cost and the operation cost of the whole industry.
In order to make the aforementioned objects, features and advantages of the present invention comprehensible, embodiments accompanied with figures are described in further detail below.
Fig. 1 is a schematic flow diagram of a cross-domain identifier resolution node data privacy protection and secure sharing method provided by the present invention, fig. 2 is a timing diagram of a cross-domain identifier resolution node data privacy protection and secure sharing method provided by the present invention, as shown in fig. 1 and fig. 2, a cross-domain identifier resolution node data privacy protection and secure sharing method provided by the present invention includes:
s101, carrying out classified division on the to-be-processed data generated by the enterprise nodes; dividing the result into 1-level privacy data, 2-level privacy data, 3-level privacy data, 4-level privacy data and 5-level privacy data; the level 1 private data is public data information; the 2-level privacy data is data which can be checked or simply encrypted and displayed in an enterprise or a company; the 3-level privacy data is encrypted and stored, and meanwhile, a plaintext is also stored, and data displayed in a desensitized manner is stored; the 4-level privacy data is enterprise privacy data which is subjected to hard encryption and desensitization preservation and is used for storing plaintext data; the 5-level privacy data is enterprise privacy data which is irreversibly encrypted and desensitized and has no plaintext data;
the data type of the enterprise node is divided into user identity data when the node is accessed and identification data when the identification is analyzed. The data is acquired when the user invokes the privacy protection service and uploads the data.
In the process of resolving the industrial internet identification, the types of protected data are divided into predefined related basic configuration data (such as IP address, subnet mask, gateway address and DNS server address), network access strategy (physical security strategy: the purpose of physical security strategy is to protect hardware entities and communication links such as computer system, network server and printer from natural disasters, artificial damage and wiring attack), identify and use authority of user and prevent user from unauthorized operation, ensure that the computer system has a good electromagnetic compatibility working environment, establish complete security management system to prevent illegal access to computer control room and various theft and damage activities, access control strategy is network access control, authority control of network, directory level security control, attribute security control, network monitoring and locking control, security control of network ports and nodes), device asset data (device capacity, device price, etc.), application and service data (application programs, service tools, etc.), user data (user name, etc.), organization data (data for an enterprise, for example, in the industrial internet), and identity resolution behavior data (for example, identity policy, resolution method, etc.).
S102, acquiring a data request initiated by an enterprise node to a node front-end module; the data request includes: a data encryption request or a data desensitization request;
s103, checking the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the encrypted data includes: desensitizing the data and ciphertext data;
after S103, further comprising:
and establishing an encryption database and a desensitization database according to the ciphertext attribute of the encrypted data.
Desensitization value and hash value of the data are stored without storing plaintext. And identity identification sensitive data in the ciphertext database stores the encrypted value and the hashed value of the data, and no plaintext exists. The server of the encrypted database is stored in a database isolation area, and the encrypted sensitive data is isolated and protected by using database firewall safety equipment in the middle. And the data in the ciphertext database can be decrypted to obtain plaintext data. And processing the plaintext data according to the desensitization rule and storing the processed plaintext data in the desensitization library.
S104, acquiring a corresponding encryption algorithm or desensitization algorithm according to the division result of the data to be processed and the data request; encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data to a corresponding database; the database includes: an encryption database and a desensitization database;
figure 3 shows the construction of an encryption/decryption and desensitization service. The current popular distributed framework Spring Boot + ZooKeeper is adopted as a basic technical framework, and the encryption and decryption service is stripped from the main business of the industrial internet identification analysis to become an independent application service program.
Specifically, an edge calculation server is arranged, and the edge calculation server is connected with production equipment through related interfaces such as RS485 and RS 232;
the method comprises the steps that an edge computing server collects equipment codes and user unique identifications of production equipment, the equipment codes and the user unique identifications are generated into digital codes by utilizing a random hash algorithm, the digital codes are generally even arrays such as 18, 21 and 46, and the number of the digital codes is determined according to the equipment codes and the number of characters of the user unique identifications;
generating a temporary and disposable code from the digital code by adopting a disposable password, wherein the effective time of the code is preset minutes, the preset minutes are related to node privacy data classification, generating a unique identity authentication code from the temporary and disposable code by an RSA algorithm, and requesting a cloud server to verify and connect by a hypertext transfer security protocol;
after receiving the request information, the cloud server performs reverse operation and decryption on the identity authentication code to determine whether the production equipment is authorized equipment or not, if the production equipment is authorized equipment and the equipment is effective, the cloud server is connected with the authorized equipment to generate a data transmission channel;
the premise is that the cloud server stores all equipment codes of the production equipment and the unique user identification;
after receiving the cloud verification success command, the edge computing server establishes connection with the cloud server, acquires the operating data of the authorization equipment by using a data transmission channel, encrypts the operating data through an irreversible encryption and desensitization algorithm, and sends encrypted ciphertexts to two corresponding databases;
and the cloud server submits the encrypted ciphertext to the data center, and the data center stores the operation data of the production equipment in the structured database.
For the realization of the irreversible encryption and desensitization algorithm, a hardware encryption equipment industrial internet data cipher machine (model: SJJ1310) is adopted as service equipment of a domestic cipher algorithm and a general cipher algorithm, the high security of the algorithm and a secret key is ensured by the cipher equipment, encryption and decryption services are applied to butt joint cipher machine equipment, and an encryption algorithm in the cipher machine is used for packaging into an external service interface for calling an industrial internet identification analysis system.
S104 specifically comprises the following steps:
when the encrypted data is desensitized data, the data is combed according to the parameter rules, the data types are judged through the regular expressions, the parameter values and the parameter types, and the desensitization of different data types and desensitization requirements is realized according to the parameter classification.
S104 specifically comprises the following steps:
when the encrypted data is desensitized data, the industrial internet identification analysis system receives a request desensitization request through encryption and decryption and desensitization service, and verifies whether a certificate is legal or not; after the verification is passed, acquiring an encryption and decryption secret key according to the desensitization data, and acquiring decrypted desensitization data in the request according to the secret key and a data decryption method;
analyzing the decrypted desensitization data, and verifying data rules by using a regular expression;
when the verification is passed, distinguishing field attributes in the entity according to a data entity model transmitted by the enterprise node, configuring a fuzzy algorithm for data of each field attribute according to a dynamic desensitization rule in a default mode, and ensuring that sensitive information is not leaked by specifying the desensitization rule and different data access strategies;
and calling a corresponding desensitization algorithm to operate the desensitization field data in the decrypted desensitization data according to the data desensitization requirement of each desensitization field and the corresponding desensitization rule, so as to obtain desensitization field data and realize data desensitization.
Analyzing the data to be stored, calling corresponding encryption keys and desensitization rules (encryption keys and desensitization rules corresponding to user attributes of natural people, enterprise users, machine equipment users and the like are preset in advance) according to the attributes (corresponding to different users, namely the user attributes of the natural people, the enterprise users, the machine equipment users and the like are all different), and performing protection processing on the data (performing irreversible encryption and desensitization algorithm encryption through the industrial internet data cipher machine in the step 1). If the ID number is encrypted, the SM4 algorithm is used for generating a cipher text, and a mask mode is used for replacing the intermediate ID number for coding when the desensitization is carried out.
And storing the encrypted data into a ciphertext database, storing desensitization data into a desensitization database, calling the ciphertext database for decrypting and returning when reading plaintext data when reading the data, and directly searching the desensitization database for returning when reading the desensitization data.
The principle of node encryption is as follows: all identification data are encrypted before being transmitted, the encryption mode can select symmetric encryption or asymmetric encryption according to the data transmission direction and type, the received message is decrypted on each node, and when the data need to be transmitted to the next link, the next key is used for encrypting the message first and then transmitting the message. A message may be transmitted over many communication links before the data reaches its destination. Since each intermediate transfer node message is decrypted and then re-encrypted, all data on the link, including the routing information, appears in ciphertext form. Therefore, the message is decrypted and then encrypted at the intermediate node, the message is not allowed to exist in a clear text form in the transmission of the network node, and the security is provided for data transmission. The node encryption process is to decrypt the received message and then encrypt it with a different key, and these encryption and decryption processes are performed in a security module on the node service.
The data desensitization technology in the invention supports the safe disposal of the sensitive information of the identification attribute data, has the data desensitization service capability, supports the automatic detection of the sensitive outgoing data, supports the automatic desensitization of the data according to a desensitization strategy, supports various control capabilities of full-text output, desensitization output, encryption output and the like, and supports the safe disposal of the sensitive information of the identification attribute data.
As shown in fig. 4, in the process of resolving the identifier of the industrial internet, there are multiple groups of data that need to be desensitized, such as identifier data, user identity data, identifier resolution result data, relevant basic configuration data, network access policy, device asset data, application and service data, organization data, and identifier resolution behavior data. According to the data desensitization technology provided by the invention, after data to be desensitized are obtained, the data are combed according to parameter rules, the data types are judged through regular expressions, parameter values and parameter types, and the desensitization of different data types and desensitization requirements according to parameter classification is realized. By fixed parameter data transmission of the data object, automatic desensitization in the data calling process can be realized, sensitive information in the service data is automatically identified and shielded, data safety is guaranteed, operation efficiency is improved, and high flexibility is achieved.
The desensitization procedure is as follows: (specific procedures for protecting incoming and outgoing data using encryption/decryption and desensitization functions for data interfacing services)
Step 1: the enterprise node initiates a request (containing request data) to the node front-end module, and calls a data desensitization interface of the node front-end module to perform desensitization operation on an incoming data object.
Step 2: the node preposition module adopts a node encryption mode to symmetrically encrypt the request data message.
And step 3: the node front module carries a message and an accessible authentication certificate to call a data desensitization interface of the industrial Internet identity resolution system.
And 4, step 4: the encryption and decryption and desensitization service of the industrial internet identification analysis system receives the request message, verifies whether the certificate is legal or not, forwards data to be desensitized to an independent encryption and decryption service module after the verification is passed, acquires an encryption and decryption secret key of a node front module according to a symmetric encryption scheme of a node encryption mode, and acquires plaintext data in the request message according to the secret key and a data decryption method.
And 5: and analyzing the data to be desensitized according to the transmitted data model, and verifying the data rule by using a regular expression. And 6, the verification mode is to judge the reasonability and the legality of the data uploaded by the enterprise node, for the data of the fixed data model, the character length, the character type and the character arrangement rule of the regular expression are matched, the step 6 is executed after the verification is passed, the data is verified and judged to have the fault service termination, and the fault report is returned to the enterprise node.
Step 6: the method comprises the steps of distinguishing field attributes in an entity according to a data entity model transmitted by an enterprise node, configuring a fuzzy algorithm for data of each field attribute by default according to a dynamic desensitization rule, wherein all needed desensitization service data in the industrial internet identification analysis desensitization service are fixed data models, so that a directional discovery mode is adopted for desensitization data discovery, namely seven data models of predefining related basic configuration data, network access strategies, equipment asset data, application and service data, user data, organization data and identification analysis behavior data are defined, and sensitive information is guaranteed not to be leaked by specifying the desensitization rule and different data access strategies aiming at the data.
And 7: and aiming at each desensitization field, different data desensitization requirements are possessed, corresponding desensitization rules are obtained according to the characteristics of the desensitization field, and corresponding desensitization algorithms are called to operate on the desensitization field data in the desensitization data, so that desensitization of the entity data is realized. The desensitization scheme is established by means of desensitization strategies and desensitization algorithms, wherein the desensitization of non-reversible data can be achieved by directly calculating in modes of truncation, masking and the like, the desensitization can also be directly calculated by reversible data desensitization replacement, rearrangement, date migration rounding and the like, and when encryption desensitization is involved, password encryption facilities need to be docked. Ciphertext desensitization data is obtained.
And 8: desensitization service transfers desensitization data back to the identification analysis system, the identification analysis system transfers the desensitization data to a node front module of the enterprise node in a node encryption mode, the node front module decrypts the desensitization data by a fixed effective secret key and returns the desensitization data to the enterprise node, and the process calls a complete step description of the industrial internet identification analysis desensitization service for the enterprise node.
The data desensitization technology in the invention has the following characteristics: availability, data association relationships, business rule relationships, data distribution, ease of use, and customizability. When desensitizing different service data, a good desensitizing method is formulated, which is the key point of the whole data desensitization, and the data desensitizing step of the scheme mainly comprises the following steps: and 7, identifying the type of the identification analysis data by defining a data entity model, and defining an algorithm according to the field attribute to realize automatic desensitization of the specified identification data according to a predefined rule. Meanwhile, different enterprises can share the data grading model, and define the data grade of the enterprises according to the business conditions of the enterprises; meanwhile, desensitization technology can be shared, and the safety of self data is realized.
Specifically, the shared desensitization technique comprises the following steps:
(1) establishing a shared data set, defining own data grade of shared data among different enterprises according to own service conditions to form an enterprise data set, and forming the shared data set by a plurality of enterprise data sets;
(2) enterprises corresponding to the enterprise data sets jointly construct data screening conditions, wherein the data screening conditions are created for auditing the data sharing enterprises, and the enterprises participating in sharing are made;
(3) reading a data set, screening out data meeting desensitization property through data screening conditions, and sorting and recording the data into D;
(4) the anonymized data obtain an equivalent group M;
(5) extracting quasi-identifier QI set in M, wherein the quasi-identifier value of the ith piece of data is represented by QIi;
(6) if the quasi-identifier range [ QInewmin, QInewmax ] to be changed is given, step 8 is directly executed;
(7) if the initial input does not give a new quasi-identifier range, the system automatically gives the new quasi-identifier range, and judges the original range [ QImin, QImax ], wherein QInewmax > QImax, and QInewmin < QImin;
(8) entering a normalization function: processing and mapping the interval of the QI set;
(9) obtaining a new quasi-identifier value epsilon k and inputting the quasi-identifier value epsilon k into a new set equivalence group M';
(10) compensating the diversity of the sensitive attributes by using a diversity method;
(11) after new desensitization data are obtained, comparing the sensitivity attributes SAi in [ QInewmin, QInewmax ], and judging whether the diversity is met in the equivalent group M;
(12) if there is no attribute SAi, a quasi-identifier QIi and any other sensitive attribute SAi are arbitrarily supplemented within the range of the corresponding equivalence group M;
(13) recording a desensitized data set D' satisfying the conditions;
(14) d' is output and issued, and sharing is completed.
And S105, when a request for data query is acquired, the identification analysis system directly acquires data from the corresponding database in a node encryption mode, and transmits the acquired data to the node front-end module of the enterprise node, and the node front-end module decrypts the acquired data and transmits the decrypted data to the enterprise node.
A cross-domain identification analysis node data privacy protection and security sharing system is used for the cross-domain identification analysis node data privacy protection and security sharing method, and comprises the following steps:
the enterprise node is used for generating data to be processed; the data to be processed comprises: encrypting and decrypting data and desensitizing data;
the node front-end module is used for data encryption uploading, encrypted data acquisition, desensitization data acquisition and data decryption;
the privacy confidentiality module is used for verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the system is also used for reading a private key of an asymmetric encryption algorithm according to the visiting enterprise node identification, calling an interface of encryption and decryption and desensitization service, and decrypting ciphertext data;
the encryption, decryption and desensitization module is used for encrypting data in an asymmetric encryption mode of a cryptographic technology and realizing network link data transmission between the node front-end module and the privacy protection module in a ciphertext data form; the method is also used for carrying out rule verification according to data model attribute classification when data needs desensitization, and then calling a corresponding desensitization algorithm to realize rapid data desensitization;
different servers are used for establishing and creating an encryption database and a desensitization database (see the desensitization database and the encryption database in fig. 2), and the encryption database and the desensitization database are respectively bridged according to two different encryption or desensitization business processes when data are newly added, deleted and maintained. The link database mode uses JDBC (Java database connection) mode. And the link addresses of the double databases are distinguished by adopting an ip + port mode in the program.
When the identification is analyzed for data query, the enterprise node reads the uploaded equipment asset data in the enterprise through the node preposition module, the enterprise usually only displays desensitization data when reading a data list, the enterprise node retrieves the equipment asset data through the unique equipment identification, namely the equipment mac address, the process is that the enterprise node sends a data retrieval request to the node preposition module, the node preposition module encrypts the request message and forwards the request message to the privacy protection module, the privacy protection module decrypts the request message to obtain the request information, retrieves the desensitization data from the desensitization database and encrypts the desensitization data and returns the desensitization data to the node preposition module, and the node preposition module decrypts the desensitization data and returns the desensitization data to the enterprise node.
A desensitization database for storing desensitized data;
and the encryption database is used for storing the encrypted data.
The node front module comprises: the data encryption system comprises a data encryption uploading interface, an encrypted data acquisition interface, a desensitization data acquisition interface and a data decryption interface.
The method includes the steps that an interface is established to provide services for the outside (for example, a special interface is established for data encryption uploading), and service modes are divided into a mode of packaging an SDK (software development kit) mode for a node user to import and call, a mode of issuing a webservice interface and an https (hypertext transfer protocol) interface for the node user to call directly and the like.
When the interface is established, firstly, different calling addresses are defined according to different business rules, parameters are defined and checked, business coding is realized according to the business rules, and a result is returned after data is processed. When a user uses the node front module, firstly, an interface address needs to be selected according to own service requirements, a parameter is transmitted according to an interface calling method issued by the node front module, a request is initiated, and whether service calling is successful or not is judged according to an interface return parameter value.
The node front-end module further comprises: a node privacy data classification model based on service attributes;
and the node privacy data grading model based on the service attributes is used for grading and dividing the privacy data of the to-be-processed data generated by the enterprise nodes.
The embodiments in the present description are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. For the system disclosed by the embodiment, the description is relatively simple because the system corresponds to the method disclosed by the embodiment, and the relevant points can be referred to the method part for description.
The principles and embodiments of the present invention have been described herein using specific examples, which are provided only to help understand the method and the core concept of the present invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, the specific embodiments and the application range may be changed. In view of the above, the present disclosure should not be construed as limiting the invention.
Claims (7)
1. A cross-domain identification analysis node data privacy protection and secure sharing method is characterized by comprising the following steps:
carrying out classified division on the private data of the data to be processed generated by the enterprise nodes; dividing the result into 1-level privacy data, 2-level privacy data, 3-level privacy data, 4-level privacy data and 5-level privacy data; the level 1 private data is public data information; the 2-level privacy data is data which can be checked or simply encrypted and displayed in an enterprise or a company; the 3-level privacy data is encrypted and stored, and meanwhile, a plaintext is also stored, and data displayed in a desensitized manner is stored; the 4-level privacy data is enterprise privacy data which is subjected to hard encryption and desensitization preservation and is used for storing plaintext data; the 5-level privacy data is enterprise privacy data which is irreversibly encrypted and desensitized and has no plaintext data;
acquiring a data request initiated by an enterprise node to a node front-end module; the data request includes: a data encryption request or a data desensitization request;
verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the encrypted data includes: desensitizing the data and ciphertext data;
acquiring a corresponding encryption algorithm or desensitization algorithm according to a division result of the data to be processed and a data request; encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data to a corresponding database; the database includes: an encryption database and a desensitization database;
when a request for data query is obtained, the identification analysis system directly obtains data from a corresponding database in a node encryption mode, the obtained data are transmitted to a node front-end module of the enterprise node, and the node front-end module decrypts the obtained data and transmits the decrypted data to the enterprise node.
2. The method according to claim 1, wherein the validity of the data to be processed is checked, and when the data to be processed is valid, the data to be processed is encrypted, and then the method further comprises:
and establishing an encryption database and a desensitization database according to the ciphertext attribute of the encrypted data.
3. The method for protecting data privacy and safely sharing of the cross-domain identification resolution node according to claim 1, wherein the corresponding encryption algorithm or desensitization algorithm is obtained according to the division result of the data to be processed; and encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data into a corresponding database, wherein the method specifically comprises the following steps:
when the encrypted data is desensitized data, the data is combed according to the parameter rules, the data types are judged through the regular expressions, the parameter values and the parameter types, and the desensitization of different data types and desensitization requirements is realized according to the parameter classification.
4. The method for protecting data privacy and safely sharing of the cross-domain identification resolution node according to claim 3, characterized in that the corresponding encryption algorithm or desensitization algorithm is obtained according to the division result of the data to be processed; and encrypting or desensitizing the data by using an encryption algorithm or a desensitization algorithm, and storing the encrypted or desensitized data into a corresponding database, wherein the method specifically comprises the following steps:
when the encrypted data is desensitized data, the industrial internet identification analysis system receives a request desensitization request through encryption and decryption and desensitization service, and verifies whether a certificate is legal or not; after the verification is passed, acquiring an encryption and decryption secret key according to the desensitization data, and acquiring decrypted desensitization data in the request according to the secret key and a data decryption method;
analyzing the decrypted desensitization data, and verifying data rules by using a regular expression;
when the verification is passed, distinguishing field attributes in the entity according to a data entity model transmitted by the enterprise node, configuring a fuzzy algorithm for data of each field attribute according to a dynamic desensitization rule in a default mode, and ensuring that sensitive information is not leaked by specifying the desensitization rule and different data access strategies;
and calling a corresponding desensitization algorithm to operate the desensitization field data in the decrypted desensitization data according to the data desensitization requirement of each desensitization field and the corresponding desensitization rule, so as to obtain desensitization field data and realize data desensitization.
5. A cross-domain identifier resolution node data privacy protection and secure sharing system, configured to implement the method for data privacy protection and secure sharing of a cross-domain identifier resolution node according to any one of claims 1 to 4, the method comprising:
the enterprise node is used for generating data to be processed; the data to be processed comprises: encrypting and decrypting data and desensitizing data;
the node front-end module is used for data encryption uploading, encrypted data acquisition, desensitization data acquisition and data decryption;
the privacy confidentiality module is used for verifying the legality of the data to be processed, and encrypting the data to be processed when the data to be processed is legal; the system is also used for reading a private key of an asymmetric encryption algorithm according to the visiting enterprise node identification, calling an interface of encryption and decryption and desensitization service, and decrypting ciphertext data;
the encryption, decryption and desensitization module is used for encrypting data in an asymmetric encryption mode of a cryptographic technology and realizing network link data transmission between the node front-end module and the privacy protection module in a ciphertext data form; the method is also used for carrying out rule verification according to data model attribute classification when data needs desensitization, and then calling a corresponding desensitization algorithm to realize rapid data desensitization;
a desensitization database for storing desensitized data;
and the encryption database is used for storing the encrypted data.
6. The system of claim 5, wherein the node pre-positioning module comprises: the data encryption system comprises a data encryption uploading interface, an encrypted data acquisition interface, a desensitization data acquisition interface and a data decryption interface.
7. The system of claim 5, wherein the node front-end module further comprises: a node privacy data classification model based on service attributes;
and the node privacy data grading model based on the service attributes is used for grading and dividing the privacy data of the to-be-processed data generated by the enterprise nodes.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110907384.5A CN113591119B (en) | 2021-08-09 | 2021-08-09 | Cross-domain identification analysis node data privacy protection and safety sharing method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110907384.5A CN113591119B (en) | 2021-08-09 | 2021-08-09 | Cross-domain identification analysis node data privacy protection and safety sharing method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113591119A true CN113591119A (en) | 2021-11-02 |
| CN113591119B CN113591119B (en) | 2022-03-22 |
Family
ID=78256299
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110907384.5A Active CN113591119B (en) | 2021-08-09 | 2021-08-09 | Cross-domain identification analysis node data privacy protection and safety sharing method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113591119B (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114040404A (en) * | 2021-11-08 | 2022-02-11 | 中国电信股份有限公司 | Data distribution method, system, device and storage medium |
| CN114785618A (en) * | 2022-06-16 | 2022-07-22 | 广州万协通信息技术有限公司 | Data communication method and system based on adjacent node secondary authentication |
| CN114780963A (en) * | 2022-04-13 | 2022-07-22 | 苏州砺行信息科技有限公司 | Security reinforcement method and system for identification analysis data |
| CN115242529A (en) * | 2022-07-26 | 2022-10-25 | 国网智能电网研究院有限公司 | Data security sharing system |
| CN116257862A (en) * | 2022-12-21 | 2023-06-13 | 上海云砺信息科技有限公司 | Data storage system based on data hierarchical classification and database transparent encryption and decryption method |
| CN116319070A (en) * | 2023-05-11 | 2023-06-23 | 中国电子信息产业集团有限公司第六研究所 | Industrial Internet identification analysis system, method, electronic equipment and storage medium |
| CN116663047A (en) * | 2023-05-11 | 2023-08-29 | 中日友好医院(中日友好临床医学研究所) | Fine-granularity safe data sharing method for privacy protection of patient health record |
| CN116881973A (en) * | 2023-09-05 | 2023-10-13 | 浙江省金融综合服务平台管理有限公司 | Financial privacy data trusted computing method and system based on multiple data sources |
| CN117194350A (en) * | 2023-11-07 | 2023-12-08 | 广东云下汇金科技有限公司 | Document storage method and system in engineering construction stage of data center |
| CN117407849A (en) * | 2023-12-14 | 2024-01-16 | 四川省电子产品监督检验所 | Industrial data security protection method and system based on industrial Internet technology |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170186007A1 (en) * | 2014-04-30 | 2017-06-29 | Visa International Service Association | Systems and methods for data desensitization |
| CN109040057A (en) * | 2018-07-26 | 2018-12-18 | 百色学院 | A kind of multi-key cipher cascade protection privacy system and method based on block chain |
| US20210044567A1 (en) * | 2018-02-06 | 2021-02-11 | Nokia Technologies Oy | Method, apparatus, and computer readable medium for providing security service for data center |
| CN112800472A (en) * | 2021-03-08 | 2021-05-14 | 国家工业信息安全发展研究中心 | Industrial internet identification data protection system based on micro-service architecture |
-
2021
- 2021-08-09 CN CN202110907384.5A patent/CN113591119B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170186007A1 (en) * | 2014-04-30 | 2017-06-29 | Visa International Service Association | Systems and methods for data desensitization |
| US20210044567A1 (en) * | 2018-02-06 | 2021-02-11 | Nokia Technologies Oy | Method, apparatus, and computer readable medium for providing security service for data center |
| CN109040057A (en) * | 2018-07-26 | 2018-12-18 | 百色学院 | A kind of multi-key cipher cascade protection privacy system and method based on block chain |
| CN112800472A (en) * | 2021-03-08 | 2021-05-14 | 国家工业信息安全发展研究中心 | Industrial internet identification data protection system based on micro-service architecture |
Non-Patent Citations (2)
| Title |
|---|
| HONG-YEN CHEN等: "The Challenge of Only One Flow Problem for Traffic Classification_in Identity Obfuscation Environments", 《IEEE ACCESS》 * |
| 周长利: "物联网隐私数据保护策略研究", 《中国优秀博硕士学位论文全文数据库（硕士）信息科技辑》 * |
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114040404A (en) * | 2021-11-08 | 2022-02-11 | 中国电信股份有限公司 | Data distribution method, system, device and storage medium |
| CN114780963A (en) * | 2022-04-13 | 2022-07-22 | 苏州砺行信息科技有限公司 | Security reinforcement method and system for identification analysis data |
| CN114785618A (en) * | 2022-06-16 | 2022-07-22 | 广州万协通信息技术有限公司 | Data communication method and system based on adjacent node secondary authentication |
| CN114785618B (en) * | 2022-06-16 | 2022-08-30 | 广州万协通信息技术有限公司 | Data communication method and system based on adjacent node secondary authentication |
| CN115242529A (en) * | 2022-07-26 | 2022-10-25 | 国网智能电网研究院有限公司 | Data security sharing system |
| CN116257862A (en) * | 2022-12-21 | 2023-06-13 | 上海云砺信息科技有限公司 | Data storage system based on data hierarchical classification and database transparent encryption and decryption method |
| CN116257862B (en) * | 2022-12-21 | 2023-10-20 | 上海云砺信息科技有限公司 | Data storage system based on data hierarchical classification and database transparent encryption and decryption method |
| CN116663047A (en) * | 2023-05-11 | 2023-08-29 | 中日友好医院(中日友好临床医学研究所) | Fine-granularity safe data sharing method for privacy protection of patient health record |
| CN116319070B (en) * | 2023-05-11 | 2023-08-11 | 中国电子信息产业集团有限公司第六研究所 | Industrial Internet identification analysis system, method, electronic equipment and storage medium |
| CN116319070A (en) * | 2023-05-11 | 2023-06-23 | 中国电子信息产业集团有限公司第六研究所 | Industrial Internet identification analysis system, method, electronic equipment and storage medium |
| CN116881973A (en) * | 2023-09-05 | 2023-10-13 | 浙江省金融综合服务平台管理有限公司 | Financial privacy data trusted computing method and system based on multiple data sources |
| CN116881973B (en) * | 2023-09-05 | 2023-12-05 | 浙江省金融综合服务平台管理有限公司 | Financial privacy data trusted computing method and system based on multiple data sources |
| CN117194350A (en) * | 2023-11-07 | 2023-12-08 | 广东云下汇金科技有限公司 | Document storage method and system in engineering construction stage of data center |
| CN117194350B (en) * | 2023-11-07 | 2024-03-15 | 广东云下汇金科技有限公司 | Document storage method and system in engineering construction stage of data center |
| CN117407849A (en) * | 2023-12-14 | 2024-01-16 | 四川省电子产品监督检验所 | Industrial data security protection method and system based on industrial Internet technology |
| CN117407849B (en) * | 2023-12-14 | 2024-02-23 | 四川省电子产品监督检验所 | Industrial data security protection method and system based on industrial Internet technology |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113591119B (en) | 2022-03-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113591119B (en) | Cross-domain identification analysis node data privacy protection and safety sharing method and system | |
| Yu et al. | Enabling attribute revocation for fine-grained access control in blockchain-IoT systems | |
| CN111212095B (en) | Authentication method, server, client and system for identity information | |
| Mehmood et al. | Protection of big data privacy | |
| CN112800472B (en) | Industrial internet identification data protection system based on micro-service architecture | |
| Jayaprakash et al. | Cloud data encryption and authentication based on enhanced Merkle hash tree method. | |
| Puthal et al. | SEEN: A selective encryption method to ensure confidentiality for big sensing data streams | |
| CN109995530B (en) | Safe distributed database interaction system suitable for mobile positioning system | |
| CN111464563A (en) | Protection method of industrial control network and corresponding device | |
| CN113111386A (en) | Privacy protection method for block chain transaction data | |
| CN116436682A (en) | Data processing method, device and system | |
| CN117040896A (en) | Internet of things management method and Internet of things management platform | |
| US20220038478A1 (en) | Confidential method for processing logs of a computer system | |
| Gupta et al. | Fog computing and its security challenges | |
| CN116232770B (en) | Enterprise network safety protection system and method based on SDN controller | |
| CN113918977A (en) | User information transmission device based on Internet of things and big data analysis | |
| CN115150109A (en) | Authentication method, device and related equipment | |
| CN111586045A (en) | Attribute encryption and dynamic security layer protection method and corresponding firewall | |
| CN116094696A (en) | Data security protection method, data security management platform, system and storage medium | |
| CN114663234A (en) | System and method for supervising abnormal transactions on block chain | |
| Qi et al. | A security transmission and early warning mechanism for intelligent sensing information in internet of things | |
| Stathopoulos et al. | Secure log management for privacy assurance in electronic communications | |
| CN115580394B (en) | Privacy data desensitization transmission method and system in property digital system | |
| Oberhofer et al. | Market Research on IIoT Standard Compliance Monitoring Providers and deriving Attributes for IIoT Compliance Monitoring | |
| Lakshminarasamma et al. | A Study on Cloud Storage Architecture and Related Technical Issues |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |