CN116821955A - User data protection method and related equipment - Google Patents

User data protection method and related equipment Download PDF

Info

Publication number
CN116821955A
CN116821955A CN202310654135.9A CN202310654135A CN116821955A CN 116821955 A CN116821955 A CN 116821955A CN 202310654135 A CN202310654135 A CN 202310654135A CN 116821955 A CN116821955 A CN 116821955A
Authority
CN
China
Prior art keywords
data
user data
user
sensitive
private
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310654135.9A
Other languages
Chinese (zh)
Inventor
张宏浩
黄梦成
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Coocaa Network Technology Co Ltd
Original Assignee
Shenzhen Coocaa Network Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Coocaa Network Technology Co Ltd filed Critical Shenzhen Coocaa Network Technology Co Ltd
Priority to CN202310654135.9A priority Critical patent/CN116821955A/en
Publication of CN116821955A publication Critical patent/CN116821955A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245Protecting personal data, e.g. for financial or medical purposes
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules

Abstract

The application discloses a user data protection method and related equipment, wherein the method comprises the following steps: collecting user data, identifying and evaluating the user data, and classifying and managing the user data according to importance and confidentiality levels; identifying private data and sensitive data in user data according to the data type, carrying out encryption storage and data backup, and setting a deleted recovery function; setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data; periodically deleting the logged-off user data and invalid user data; and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log. The application performs omnibearing protection on the aspects of collection, storage, management, access and the like of the user data, and ensures the safety and reliability of the data.

Description

User data protection method and related equipment
Technical Field
The present application relates to the field of computer software technologies, and in particular, to a user data protection method, system, terminal, and computer readable storage medium.
Background
With the increasing importance of user data, it is becoming more and more important to protect the security of user data. In the prior art, although there are various encryption means and access control strategies, there are many security and reliability problems for data collection, storage, management, access and the like.
The data security and reliability refer to the problem that the data may be leaked or tampered manually in the processes of collection, storage, management and access, so that the data is problematic in normal use or display of a user, and the data directly affects the user. For example, in the storage process, sensitive data of the user, such as mobile phone numbers, identity card numbers and the like, and if the sensitive data is not ciphertext storage, the risk of leakage of user information exists.
Accordingly, the prior art is still in need of improvement and development.
Disclosure of Invention
The application mainly aims to provide a user data protection method, a system, a terminal and a computer readable storage medium, which aim to solve the problems of safety and reliability of user data caused by low protection safety of the user data in the prior art.
In order to achieve the above object, the present application provides a user data protection method, including the steps of:
collecting user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels;
identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function;
setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data;
periodically deleting the logged-off user data and invalid user data;
and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log.
Optionally, the user data protection method, wherein the user data includes personal information, behavior record information, device information and service association data.
Optionally, the user data protection method, wherein the identifying and evaluating the user data by using preset standards and rules specifically includes:
and identifying and evaluating confidentiality, integrity and availability of the user data by adopting preset standards and rules.
Optionally, in the user data protection method, the private data and the sensitive data are stored in a database established by a cloud server in an encrypted manner, and the user attribute and the key are stored in different databases separately.
Optionally, the user data protection method, wherein the private data and the sensitive data encryption mode include AES encryption and aes+rsa encryption.
Optionally, in the user data protection method, the setting the deleted recovery function specifically includes:
the recovery mechanism is the reverse operation of user logout, if the user logout the user data, the cold static period of the preset time is set;
and in the cold period, recovering the data according to the user requirement, wherein the original data is unchanged after recovery, and if the user does not recover, deleting the data after the cold period is finished.
Optionally, the user data protection method, wherein the user data protection method further includes:
after classifying the user data, storing the data with different classification types in different data tables according to the classification result.
In addition, to achieve the above object, the present application also provides a user data protection system, wherein the user data protection system includes:
the data acquisition and classification module is used for acquiring user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels;
the data identification storage module is used for identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function;
the authority access setting module is used for setting user authority for accessing the privacy data and the sensitive data based on an access control model of a role, and an authorized user has the authority for accessing the privacy data and the sensitive data;
the data periodic deleting module is used for periodically deleting the logged-off user data and invalid user data;
and the data security monitoring module is used for recording the log of the access, modification and deletion operation of the user data and carrying out security monitoring on the user data according to the log.
In addition, to achieve the above object, the present application also provides a terminal, wherein the terminal includes: the system comprises a memory, a processor and a user data protection program stored on the memory and capable of running on the processor, wherein the user data protection program realizes the steps of the user data protection method when being executed by the processor.
In addition, in order to achieve the above object, the present application also provides a computer-readable storage medium storing a user data protection program which, when executed by a processor, implements the steps of the user data protection method as described above.
In the application, user data are collected, the user data are identified and evaluated by adopting preset standards and rules, and the user data are classified and managed according to importance and confidentiality levels; identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function; setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data; periodically deleting the logged-off user data and invalid user data; and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log. The application performs omnibearing protection on the aspects of collection, storage, management, access and the like of the user data, and ensures the safety and reliability of the data.
Drawings
FIG. 1 is a flow chart of a preferred embodiment of the user data protection method of the present application;
FIG. 2 is a schematic diagram of a preferred embodiment of the user data protection system of the present application;
FIG. 3 is a schematic diagram of the operating environment of a preferred embodiment of the terminal of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more clear and clear, the present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
As shown in fig. 1, the user data protection method according to the preferred embodiment of the present application includes the following steps:
and S10, collecting user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels.
Specifically, the user data is collected and classified, including personal information, behavior records, equipment information, service associated data and the like, and the user data classification is a process of classifying and managing the user data according to different importance and confidentiality levels.
In hierarchical management of user data, certain criteria and rules are typically employed to identify, evaluate and classify user data, such as evaluating and ranking confidentiality, integrity, availability, etc. of data, to formulate different security policies and control measures to protect the data.
The application classifies the collected user data, including personal information, history record, preference setting and the like, and stores the user data in different data tables, wherein different types of data are stored in different data tables, and different levels of encryption modes are different. The classification mode can better protect the privacy of the user and prevent the abuse of the user data.
And step S20, identifying the private data and the sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function.
Specifically, by the definition of national standards on user data, identifying which are private data or sensitive data, judging according to data types, such as mobile phone numbers, identity card numbers and bank cards, wherein the private data or the sensitive data are all sensitive data; the user privacy data and the sensitive data are stored in an encrypted manner, for example, a database is built by a cloud server for storage, the sensitive data of the user can be stored in an encrypted manner, meanwhile, the user attribute and the secret key are stored in different databases, and the security is higher; for example, the user's data is ranked into three categories:
(1) Internal public data, not encrypted;
(2) Secret data, performing AES encryption;
(3) Confidential data is subjected to AES+RSA encryption.
Simultaneously carrying out data backup on the private data and the sensitive data to prevent important data from being lost; in addition, a deleted recovery function is set, recovery is the reverse operation of user logout, and is an active operation initiated by the user, if the user logout the account, the account will enter a cold static period, for example, the cold static period is 60 days, after the recovery, the original data is unchanged, if the user does not recover, after the cold static period is over, the data is deleted, and the previous data cannot be recovered.
The application adopts the distributed storage (the distributed storage refers to the storage mode of dispersing and storing data on a plurality of computers or servers so as to improve the storage capacity, the data reliability and the expandability, has the advantages of expanding, high reliability, high performance and the like), encryption storage and other technologies, and ensures the safety of user data. In addition, a data backup and recovery mechanism is realized, and the integrity and usability of the user data are ensured.
And step S30, setting user permission for accessing the private data and the sensitive data based on a role-based access control model, wherein the authorized user has the permission for accessing the private data and the sensitive data.
Specifically, access control is performed on the user data, and only authorized users can access the user data. User authorization and internal authorization: the system can acquire related data after the user authorization; after the security evaluation and the auditing are carried out inside, the data authorized by the user can be used after the authorization is carried out.
The present application employs a role-based access control model (RBAC, which uses roles as an allocation unit of permissions to control user access to system resources according to the roles and responsibilities of the users, each user is allocated to one or more roles, and each role has a specific set of permissions. The access control strategy can better protect user data and prevent illegal access.
And step S40, the logged-off user data and invalid user data are deleted periodically.
Specifically, the logged-off user data and invalid user data (for example, if the account numbers are combined, that is, one account number becomes invalid, for example, if a WeChat is first registered as a platform account number and a mobile phone number is then registered as a platform account number, two account numbers are formed, after the WeChat is logged in, the mobile phone number is unbound, and one of the account numbers is combined into an invalid account number) are deleted periodically, so that the storage space occupied by the useless data is avoided and the privacy safety of the user data is ensured.
The application periodically cleans invalid data, realizes a data backup and recovery mechanism, and ensures the integrity and availability of user data. The regular cleaning strategy can better protect user data and prevent useless data from occupying storage space.
And S50, recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log.
Specifically, logs of access, modification, deletion and other operations of the user data are recorded, so that an administrator can audit and monitor the user data, the audit and the monitoring are mainly performed on the use of the user data, illegal use and excessive use of the user data are prevented, and the use of the user data is minimized.
The application records the logs of the operations such as accessing, modifying and deleting the user data, realizes the centralized management and audit of the logs, and can better ensure the traceability and the safety of the data.
The application provides a complete and omnibearing user data protection mechanism, which performs omnibearing protection on the aspects of data collection, storage, management, access and the like, and ensures the safety and reliability of the data.
Further, the present application may also be based on a user data protection mechanism of blockchain technology: the method utilizes a blockchain technology to perform decentralization storage and management on user data (the application of a distributed computing paradigm, which can realize storage and management of the data without central control, has the core idea that the data is stored on a plurality of nodes in a network in a scattered manner, each node is equal, and a centralized server is not used for controlling the whole system. User data protection mechanisms based on cryptography techniques are also possible: the encryption processing is carried out on the user data by utilizing the cryptography technology, so that higher-level data protection is realized, and meanwhile, the problems of access efficiency and data use are also required to be solved.
Further, as shown in fig. 2, based on the above-mentioned user data protection method, the present application further provides a user data protection system, where the user data protection system includes:
the data collection and classification module 51 is configured to collect user data, identify and evaluate the user data by using preset standards and rules, and classify and manage the user data according to importance and confidentiality levels;
the data identification storage module 52 is configured to identify private data and sensitive data in the user data according to a data type, encrypt the private data and the sensitive data for storage and data backup, and set a deleted recovery function;
the permission access setting module 53 is configured to set a user permission to access the private data and the sensitive data based on an access control model of a role, where an authorized user has permission to access the private data and the sensitive data;
a data periodic deletion module 54, configured to delete the logged-off user data and the invalid user data periodically;
and the data security monitoring module 55 is used for recording the log of the access, modification and deletion operation of the user data and carrying out security monitoring on the user data according to the log.
Further, as shown in fig. 3, based on the above-mentioned user data protection method and system, the present application further provides a terminal correspondingly, where the terminal includes a processor 10, a memory 20 and a display 30. Fig. 3 shows only some of the components of the terminal, but it should be understood that not all of the illustrated components are required to be implemented and that more or fewer components may alternatively be implemented.
The memory 20 may in some embodiments be an internal storage unit of the terminal, such as a hard disk or a memory of the terminal. The memory 20 may in other embodiments also be an external storage device of the terminal, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card) or the like, which are provided on the terminal. Further, the memory 20 may also include both an internal storage unit and an external storage device of the terminal. The memory 20 is used for storing application software installed in the terminal and various data, such as program codes of the installation terminal. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, the memory 20 has stored thereon a user data protection program 40, the user data protection program 40 being executable by the processor 10 to implement the user data protection method of the present application.
The processor 10 may in some embodiments be a central processing unit (Central Processing Unit, CPU), microprocessor or other data processing chip for executing program code or processing data stored in the memory 20, for example for performing the user data protection method or the like.
The display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, or the like in some embodiments. The display 30 is used for displaying information at the terminal and for displaying a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.
In one embodiment, the following steps are implemented when the processor 10 executes the user data protection program 40 in the memory 20:
collecting user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels;
identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function;
setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data;
periodically deleting the logged-off user data and invalid user data;
and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log.
Wherein the user data includes personal information, behavior record information, device information, and business-related data.
Wherein, the user data is identified and evaluated by adopting preset standards and rules, specifically:
and identifying and evaluating confidentiality, integrity and availability of the user data by adopting preset standards and rules.
The privacy data and the sensitive data are stored in a database established by a cloud server in an encrypted mode, and the user attribute and the secret key are stored in different databases separately.
The privacy data and the sensitive data encryption modes comprise AES encryption and AES+RSA encryption.
Wherein, the setting the deleted recovery function specifically includes:
the recovery mechanism is the reverse operation of user logout, if the user logout the user data, the cold static period of the preset time is set;
and in the cold period, recovering the data according to the user requirement, wherein the original data is unchanged after recovery, and if the user does not recover, deleting the data after the cold period is finished.
The user data protection method further comprises the following steps:
after classifying the user data, storing the data with different classification types in different data tables according to the classification result.
The present application also provides a computer-readable storage medium storing a user data protection program which, when executed by a processor, implements the steps of the user data protection method as described above.
In summary, the present application provides a method for protecting user data and related devices, where the method includes: collecting user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels; identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function; setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data; periodically deleting the logged-off user data and invalid user data; and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log. The application performs omnibearing protection on the aspects of collection, storage, management, access and the like of the user data, and ensures the safety and reliability of the data.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or terminal comprising the element.
Of course, those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by a computer program for instructing relevant hardware (e.g., processor, controller, etc.), the program may be stored on a computer readable storage medium, and the program may include the above described methods when executed. The computer readable storage medium may be a memory, a magnetic disk, an optical disk, etc.
It is to be understood that the application is not limited in its application to the examples described above, but is capable of modification and variation in light of the above teachings by those skilled in the art, and that all such modifications and variations are intended to be included within the scope of the appended claims.

Claims (10)

1. A method for protecting user data, the method comprising:
collecting user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels;
identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function;
setting user rights for accessing the private data and the sensitive data based on a role-based access control model, wherein an authorized user has rights for accessing the private data and the sensitive data;
periodically deleting the logged-off user data and invalid user data;
and recording a log of access, modification and deletion operations of the user data, and carrying out security monitoring on the user data according to the log.
2. The method of claim 1, wherein the user data includes personal information, behavior record information, device information, and business-related data.
3. The method for protecting user data according to claim 1, wherein the user data is identified and evaluated using preset criteria and rules, specifically:
and identifying and evaluating confidentiality, integrity and availability of the user data by adopting preset standards and rules.
4. The user data protection method of claim 1, wherein the private data and the sensitive data are stored encrypted in a database established by a cloud server, and the user attributes and keys are stored separately in different databases.
5. The method of claim 1, wherein the private data and the sensitive data encryption scheme include AES encryption and aes+rsa encryption.
6. The method for protecting user data according to claim 1, wherein the setting of the deleted recovery function specifically comprises:
the recovery mechanism is the reverse operation of user logout, if the user logout the user data, the cold static period of the preset time is set;
and in the cold period, recovering the data according to the user requirement, wherein the original data is unchanged after recovery, and if the user does not recover, deleting the data after the cold period is finished.
7. The user data protection method of claim 1, wherein the user data protection method further comprises:
after classifying the user data, storing the data with different classification types in different data tables according to the classification result.
8. A user data protection system, the user data protection system comprising:
the data acquisition and classification module is used for acquiring user data, identifying and evaluating the user data by adopting preset standards and rules, and classifying and managing the user data according to importance and confidentiality levels;
the data identification storage module is used for identifying private data and sensitive data in the user data according to the data type, carrying out encryption storage and data backup on the private data and the sensitive data, and setting a deleted recovery function;
the authority access setting module is used for setting user authority for accessing the privacy data and the sensitive data based on an access control model of a role, and an authorized user has the authority for accessing the privacy data and the sensitive data;
the data periodic deleting module is used for periodically deleting the logged-off user data and invalid user data;
and the data security monitoring module is used for recording the log of the access, modification and deletion operation of the user data and carrying out security monitoring on the user data according to the log.
9. A terminal, the terminal comprising: memory, a processor and a user data protection program stored on the memory and executable on the processor, which user data protection program, when executed by the processor, implements the steps of the user data protection method according to any of claims 1-7.
10. A computer readable storage medium, characterized in that the computer readable storage medium stores a user data protection program, which when executed by a processor implements the steps of the user data protection method according to any of claims 1-7.
CN202310654135.9A 2023-06-02 2023-06-02 User data protection method and related equipment Pending CN116821955A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310654135.9A CN116821955A (en) 2023-06-02 2023-06-02 User data protection method and related equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310654135.9A CN116821955A (en) 2023-06-02 2023-06-02 User data protection method and related equipment

Publications (1)

Publication Number Publication Date
CN116821955A true CN116821955A (en) 2023-09-29

Family

ID=88140152

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310654135.9A Pending CN116821955A (en) 2023-06-02 2023-06-02 User data protection method and related equipment

Country Status (1)

Country Link
CN (1) CN116821955A (en)

Similar Documents

Publication Publication Date Title
EP2551786B1 (en) Efficient securing of data on mobile devices
CA2738466C (en) Apparatus for shielding sensitive file, server computer of the same, method and computer program product for the same
US9348984B2 (en) Method and system for protecting confidential information
US8281388B1 (en) Hardware secured portable storage
CN103632080B (en) A kind of mobile data applications method for security protection based on USBKey
CN102043927B (en) Data divulgence protection method for computer system
JP2019500679A (en) System and method for anonymizing log entries
US8577809B2 (en) Method and apparatus for determining and utilizing value of digital assets
KR100380807B1 (en) Portable terminals, servers, systems, and their program recording mediums
JP2007140798A (en) Information leakage prevention system for computer
CN101827101A (en) Information asset protection method based on credible isolated operating environment
US20110126293A1 (en) System and method for contextual and behavioral based data access control
CN104573530A (en) Security reinforcing system for server
CN109684866A (en) A kind of safe USB disk system for supporting multi-user data to protect
CN117614734A (en) Cloud primary container boundary authority identification method and device
Raisian et al. Security issues model on cloud computing: A case of Malaysia
Ghazinour et al. An autonomous model to enforce security policies based on user's behavior
CN116595573A (en) Data security reinforcement method and device for traffic management information system
JP7180073B2 (en) Judgment program, judgment method, and judgment device
Alawneh et al. Defining and analyzing insiders and their threats in organizations
CN116821955A (en) User data protection method and related equipment
Nanda et al. Oracle Privacy Security Auditing: Includes Federal Law Compliance with HIPAA, Sarbanes-Oxley & the Gramm-Leach-Bliley Act GLB
Chang et al. Design of inside information leakage prevention system in ubiquitous computing environment
JP4371995B2 (en) Shared file access control method, system, server device, and program
JP4468755B2 (en) Log management apparatus, log management method, and log management program

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination