CN116842544A - Data security management method, data security management device and data security management system - Google Patents

Data security management method, data security management device and data security management system Download PDF

Info

Publication number
CN116842544A
CN116842544A CN202310831494.7A CN202310831494A CN116842544A CN 116842544 A CN116842544 A CN 116842544A CN 202310831494 A CN202310831494 A CN 202310831494A CN 116842544 A CN116842544 A CN 116842544A
Authority
CN
China
Prior art keywords
data
host
user
request
security management
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310831494.7A
Other languages
Chinese (zh)
Inventor
房健
解楠
汤志倩
黄学勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shandong Pratt & Whitney Sharing Economic And Technological Development Co ltd
Original Assignee
Shandong Pratt & Whitney Sharing Economic And Technological Development Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shandong Pratt & Whitney Sharing Economic And Technological Development Co ltd filed Critical Shandong Pratt & Whitney Sharing Economic And Technological Development Co ltd
Priority to CN202310831494.7A priority Critical patent/CN116842544A/en
Publication of CN116842544A publication Critical patent/CN116842544A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/602Providing cryptographic facilities or services
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245Protecting personal data, e.g. for financial or medical purposes
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107File encryption

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to the field of data management, and particularly discloses a data security management method, a data security management device and a data security management system; the invention acquires verification data by collecting user biological information and processing according to a user using mode, the host verifies whether the request terminal accords with the acquired data according to the collected information, when the terminal data accords with the acquired data, the host responds to the terminal request, when the name number of the terminal machine is inconsistent with the acquired data of the host, the host can call biological information such as user fingerprints, facial features, sounds and the like to verify, if the account data request relates to a hierarchical processing standard, whether the request accords with the normal operation of a related account or not is judged according to information such as login time, login address, request frequency, processing data magnitude and the like, if the request accords with the login time, the user request is responded, and if the request does not accord with the login time, the request is called for combining and verifying two split password packages, so that the data has enough security when the data is transmitted outwards.

Description

Data security management method, data security management device and data security management system
Technical Field
The invention belongs to the technical field of data management, and particularly relates to a data security management method, a data security management device and a data security management system.
Background
In the big data age, the generation, circulation and application of data are becoming more common and intensive, the security boundary of an information system is more fuzzy, new and unknown security holes and hidden dangers can be generated, communication information between distributed nodes and big data related components is easy to intercept and analyze, and the application of a distributed data resource pool causes difficulty in user data isolation. With the wide and multi-source collection of data, big data self security and personal information protection present new challenges.
The data interaction management between the current terminal and the host is mainly verified by account passwords, and the verification mode is convenient, but the problem of data leakage possibly occurs after the account passwords of the user are leaked.
Disclosure of Invention
The invention aims to provide a data security management method, a data security management device and a data security management system, which are used for solving the problems in the background technology.
In order to achieve the above purpose, the present invention provides the following technical solutions:
the data security management method specifically comprises the following steps:
s1, creating an account and setting a password, and generating a password package at the same time;
s2, the host encrypts and stores data sent by the user terminal;
s3, the host computer carries out hierarchical processing to store data and corresponds to passwords of different levels;
s4, the host judges the user request, and the user requests corresponding data according to different levels of passwords.
Preferably, in S1, two cipher packages a and b are generated simultaneously, and the cipher packages a and b are separately disposed inside the host and the terminal.
Preferably, in S1, the host collects biometric information such as user fingerprint, facial features, and voice through the terminal while the user creates an account.
Preferably, in S1, the host interacts with the user terminal while the user creates an account, and the associated account corresponds to the terminal machine name number.
Preferably, in S2, the host processes the user terminal transmission information and obtains authentication data, and the processing criteria include, but are not limited to, user login time, login address, request frequency, and processing data magnitude.
Preferably, in S3, the hierarchical processing criteria include, but are not limited to, user privacy, sensitive information, data-related scope, and data processing magnitude.
Preferably, in S4, when the user terminal sends a request to the host, if the request information does not relate to the hierarchical processing standard, the user terminal is directly responded, when the user terminal request information relates to the hierarchical processing standard, the user terminal is verified according to the verification data collected in S2, if the terminal state does not conform to the verification data, the password packet is called as an auxiliary encryption mode, if the part b password in the terminal can be combined with the part a password in the host to be effective, the host responds to the request of the terminal, if the part a and the part b password can not be combined to be effective, the host locks the request of the IP address and the machine number of the terminal, and access is refused in a certain time.
The utility model provides a data security management device, includes the host computer, host computer back fixedly connected with radiator, the host computer openly articulates there is the apron that blocks the data interface, a plurality of sockets have been seted up on the apron, apron inner wall fixedly connected with and the pipe of socket intercommunication, the crooked setting of pipe, apron lateral wall fixedly connected with trick lock, the trick lock adopts fingerprint and digital dual password.
A data security management system, comprising:
the transverse override module is used for packaging a unified transverse override control device, and can ensure that the resources belong to all users through the binding relationship when the users operate any resources by establishing the binding relationship between the users and the operable resources;
the vertical override module abstracts a rule set through an interface based on a role access control mechanism to prevent longitudinal override attack, namely, different authority roles are predefined, different authorities are allocated for each role, each user belongs to a specific role, namely, has fixed authorities, and when a user executes a certain action or generates a certain action, the action or the action is judged whether to be allowed or not through the role of the user;
and a data encryption module converting the plaintext data into blocks and then applying encryption using an encryption key. The encryption process consists of various sub-processes such as sub-bytes, shifting rows, mixing columns and adding round keys. Such rounds are performed 10, 12 or 14 times depending on the size of the key. Notably, the last round does not include the mixed column sub-process and all other sub-processes performed to encrypt data;
the desensitization technology module is used for packaging a filtering and early warning tool based on sensitive data, analyzing the semantics by using an NLP technology, and automatically filtering and early warning by a sensitive word eye system;
the service security module uses distributed data storage to distribute core transaction data to a plurality of nodes, ensures that the data is not tampered through encryption and signature in a distribution link, loads the data of each node in a core service link, performs signature verification, decrypts, compares the data with the core service data, and prevents the data from being tampered.
Compared with the prior art, the invention has the beneficial effects that:
(1) According to the invention, the user biological information is collected and is processed according to the use mode of the user to obtain verification data, when the user terminal sends a data request to the host, the host verifies whether the request terminal accords with the collected data according to the collected information, when the terminal data accords with the collected data, the host responds to the terminal request, when the name number of the terminal machine is inconsistent with the collected data of the host, the host can call biological information such as user fingerprints, facial features, sounds and the like to verify, when the user logs in the account to carry out the data request, if the account data request relates to the hierarchical processing standard, whether the related account is in normal operation is required to be judged according to the information such as login time, login address, request frequency and processing data magnitude, if the related account is in accord, the user request is responded, if the related account is not in accord, the two split-type password packages are called to carry out combined verification, and therefore, the sufficient safety of the data is ensured when the data is transmitted outwards.
(2) According to the invention, the cover plate shielding interface is arranged on the host, the connecting wire between the outside and the host can be plugged with the host interface only through the socket and the guide pipe, the bent guide pipe can effectively prevent external personnel from pulling out the original connecting wire to directly acquire related information from the inside of the host, the user can access the data wire to the host interface only by opening the cover plate, and meanwhile, the coded lock arranged on the cover plate can effectively open the cover plate, so that the safety of the host data interface is improved, and the safety of data information stored in the host is further ensured.
Drawings
FIG. 1 is a block diagram of a data security management method of the present invention;
FIG. 2 is a schematic diagram of the overall structure of a data security management device according to the present invention;
FIG. 3 is a schematic view of another overall structure of the data security management apparatus according to the present invention;
FIG. 4 is a schematic diagram of a cover structure of a data security management device according to the present invention;
FIG. 5 is a block diagram of a data security management system of the present invention;
in the figure: 1. a host; 2. a heat sink; 3. a cover plate; 4. a socket; 5. a conduit; 6. a coded lock.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1, a data security management method specifically includes the following steps:
s1, creating an account and setting a password, and generating a password package at the same time;
s2, the host encrypts and stores data sent by the user terminal;
s3, the host computer carries out hierarchical processing to store data and corresponds to passwords of different levels;
s4, the host judges the user request, and the user requests corresponding data according to different levels of passwords.
According to the method, after the terminal user stores the data into the host, the host can process the data according to the data so as to adjust the difficulty of obtaining corresponding data by the user, when the terminal user sends a data request to the host, the host can judge whether the user and the user request are normal or not, and then the terminal user can respectively verify corresponding relevant passwords according to the data requests of different levels of the user so as to respond to the user request.
In S1, two password packages A and B are generated simultaneously, the first password package and the second password package are respectively arranged inside the host and the terminal, the first password package and the second password package are respectively arranged and then are used as backup options, when a user data request is abnormal, the first password and the second password can be used as auxiliary verification means to help the host to confirm the real machine used by the request terminal, and the possibility that the simulation machine imitates the terminal machine to fraudulently fetch data is avoided.
In S1, while the user creates an account, the host collects biometric information such as user fingerprint, facial features, and voice through the terminal.
In S1, while the user creates an account, the host interacts with the user terminal, and the relevant account corresponds to the terminal machine name number.
The user biological information adopted by the host can also be used as a real-time verification means, and the user account is bound with the terminal machine number, so that the host can be helped to judge whether the user has abnormal login and other conditions, and the host can conveniently verify by adopting the verification means under the abnormal conditions.
In S2, the host processes the user terminal transmission information and obtains authentication data, and the processing criteria include, but are not limited to, user login time, login address, request frequency, and processing data magnitude.
In S3, hierarchical processing criteria include, but are not limited to, user privacy, sensitive information, data-related scope, and data processing magnitude.
In S4, when the user terminal sends a request to the host, if the request information does not relate to the hierarchical processing standard, the user information is directly responded, when the user terminal request information relates to the hierarchical processing standard, the user terminal is verified according to the verification data collected in S2, such as whether the user login time accords with the account frequent login time, whether the user login address accords with the account frequent login address, whether the data request frequency of the account accords with the general operation frequency and whether the data request data volume of the account accords with the general request data volume, if the terminal state does not accord with the verification data, the password package is called as an auxiliary encryption mode, if the second password in the terminal can be combined with the first password in the host to be effective, the host responds to the terminal request, if the first password and the second password can not be combined to be effective, the host locks the terminal request IP address and the machine number, and access is refused in a certain time.
Referring to fig. 2-4, the invention also discloses a data security management device, which comprises a host (1), wherein the back of the host (1) is fixedly connected with a radiator (2), the front of the host (1) is hinged with a cover plate (3) for blocking a data interface, a plurality of jacks (4) are arranged on the cover plate (3), the inner wall of the cover plate (3) is fixedly connected with a conduit (5) communicated with the jacks, the conduit (5) is arranged in a bending manner, the outer side wall of the cover plate (3) is fixedly connected with a coded lock (6), and the coded lock (6) adopts fingerprint and digital double codes.
From the above, the data line can pass through the cover plate 3 through the socket 4 and the conduit 5 to be connected with the host 1, then the host 1 exchanges data with the outside through the data line, the bent conduit can limit the plugging of the data line and the host, the data line can be connected with the host 1 only when the cover plate 3 is opened by a user, and the bent conduit can bend the data line when the data line is plugged through the socket 4 without opening the cover plate 3 by the user, so that the data line cannot be stably plugged with the host, further, the situation that the outside person is unauthorised to pull out the data stored in the host by connecting the data line with the host is effectively avoided, and the data line can be connected with the host only by opening the cover plate 3 through the fingerprint password and the digital password by the personnel with corresponding security level.
Referring to fig. 5, the invention also discloses a data security management system, which comprises:
the transverse override module is used for packaging a unified transverse override control device, and can ensure that the resources belong to all users through the binding relationship when the users operate any resources by establishing the binding relationship between the users and the operable resources;
the vertical override module abstracts a rule set through an interface based on a role access control mechanism to prevent longitudinal override attack, namely, different authority roles are predefined, different authorities are allocated for each role, each user belongs to a specific role, namely, has fixed authorities, and when a user executes a certain action or generates a certain action, the action or the action is judged whether to be allowed or not through the role of the user;
and a data encryption module converting the plaintext data into blocks and then applying encryption using an encryption key. The encryption process consists of various sub-processes such as sub-bytes, shifting rows, mixing columns and adding round keys. Such rounds are performed 10, 12 or 14 times depending on the size of the key. Notably, the last round does not include the mixed column sub-process and all other sub-processes performed to encrypt data;
the desensitization technology module is used for packaging a filtering and early warning tool based on sensitive data, analyzing the semantics by using an NLP technology, and automatically filtering and early warning by a sensitive word eye system;
the service security module uses distributed data storage to distribute core transaction data to a plurality of nodes, ensures that the data is not tampered through encryption and signature in a distribution link, loads the data of each node in a core service link, performs signature verification, decrypts, compares the data with the core service data, and prevents the data from being tampered.
Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.

Claims (9)

1. The data security management method is characterized by comprising the following steps of:
s1, creating an account and setting a password, and generating a password package at the same time;
s2, the host encrypts and stores data sent by the user terminal;
s3, the host computer carries out hierarchical processing to store data and corresponds to passwords of different levels;
s4, the host judges the user request, and the user requests corresponding data according to different levels of passwords.
2. A data security management method according to claim 1, wherein: in S1, two password packages A and B are generated simultaneously, and the password packages A and B are respectively arranged inside the host and the terminal.
3. A data security management method according to claim 1, wherein: in S1, while the user creates an account, the host collects biometric information such as user fingerprint, facial features, and voice through the terminal.
4. A data security management method according to claim 1, wherein: in S1, while the user creates an account, the host interacts with the user terminal, and the relevant account corresponds to the terminal machine name number.
5. A data security management method according to claim 1, wherein: in S2, the host processes the user terminal transmission information and obtains authentication data, and the processing criteria include, but are not limited to, user login time, login address, request frequency, and processing data magnitude.
6. A data security management method according to claim 1, wherein: in S3, hierarchical processing criteria include, but are not limited to, user privacy, sensitive information, data-related scope, and data processing magnitude.
7. A data security management method according to claim 1, wherein: in S4, when the user terminal sends a request to the host, if the request information does not relate to the grading processing standard, the user terminal is directly responded, when the user terminal request information relates to the grading processing standard, the user terminal is verified according to the verification data collected in S2, if the terminal state does not accord with the verification data, a password packet is called as an auxiliary encryption mode, if the second password in the terminal can be combined with the first password in the host to take effect, the host responds to the request of the terminal, if the first password and the second password can not be combined to take effect, the host locks the request of the IP address and the machine number of the terminal, and access is refused in a certain time.
8. A data security management apparatus, characterized in that: including host computer (1), host computer (1) back fixedly connected with radiator (2), host computer (1) openly articulates there is apron (3) that block data interface, a plurality of sockets (4) have been seted up on apron (3), apron (3) inner wall fixedly connected with pipe (5) with socket intercommunication, pipe (5) crooked setting, apron (3) lateral wall fixedly connected with trick lock (6), trick lock (6) adopt fingerprint and digital double password.
9. A data security management system, comprising:
the transverse override module is used for packaging a unified transverse override control device, and can ensure that the resources belong to all users through the binding relationship when the users operate any resources by establishing the binding relationship between the users and the operable resources;
the vertical override module abstracts a rule set through an interface based on a role access control mechanism to prevent longitudinal override attack, namely, different authority roles are predefined, different authorities are allocated for each role, each user belongs to a specific role, namely, has fixed authorities, and when a user executes a certain action or generates a certain action, the action or the action is judged whether to be allowed or not through the role of the user;
and a data encryption module converting the plaintext data into blocks and then applying encryption using an encryption key. The encryption process consists of various sub-processes such as sub-bytes, shifting rows, mixing columns and adding round keys. Such rounds are performed 10, 12 or 14 times depending on the size of the key. Notably, the last round does not include the mixed column sub-process and all other sub-processes performed to encrypt data;
the desensitization technology module is used for packaging a filtering and early warning tool based on sensitive data, analyzing the semantics by using an NLP technology, and automatically filtering and early warning by a sensitive word eye system;
the service security module uses distributed data storage to distribute core transaction data to a plurality of nodes, ensures that the data is not tampered through encryption and signature in a distribution link, loads the data of each node in a core service link, performs signature verification, decrypts, compares the data with the core service data, and prevents the data from being tampered.
CN202310831494.7A 2023-07-07 2023-07-07 Data security management method, data security management device and data security management system Pending CN116842544A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310831494.7A CN116842544A (en) 2023-07-07 2023-07-07 Data security management method, data security management device and data security management system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310831494.7A CN116842544A (en) 2023-07-07 2023-07-07 Data security management method, data security management device and data security management system

Publications (1)

Publication Number Publication Date
CN116842544A true CN116842544A (en) 2023-10-03

Family

ID=88170325

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310831494.7A Pending CN116842544A (en) 2023-07-07 2023-07-07 Data security management method, data security management device and data security management system

Country Status (1)

Country Link
CN (1) CN116842544A (en)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103279431A (en) * 2013-05-23 2013-09-04 青岛海信宽带多媒体技术有限公司 Access method for kinds of permissions of memorizer
CN105260665A (en) * 2015-09-24 2016-01-20 惠州Tcl移动通信有限公司 Information protection method and device
CN112380552A (en) * 2020-11-20 2021-02-19 惠州Tcl移动通信有限公司 Data processing method and device, storage medium and computer equipment
CN112559991A (en) * 2020-12-21 2021-03-26 深圳市科力锐科技有限公司 System secure login method, device, equipment and storage medium
CN113766028A (en) * 2021-09-09 2021-12-07 图易(常熟)信息技术有限公司 Content copyright encryption traceability system and method based on cloud network
CN113938284A (en) * 2021-12-16 2022-01-14 佛山职业技术学院 Multi-connection encryption and decryption method, device and system based on gesture displacement
WO2022070212A1 (en) * 2020-09-30 2022-04-07 Sekhar Rao Balaga Methods and systems for performing secure clickless authentication

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103279431A (en) * 2013-05-23 2013-09-04 青岛海信宽带多媒体技术有限公司 Access method for kinds of permissions of memorizer
CN105260665A (en) * 2015-09-24 2016-01-20 惠州Tcl移动通信有限公司 Information protection method and device
WO2022070212A1 (en) * 2020-09-30 2022-04-07 Sekhar Rao Balaga Methods and systems for performing secure clickless authentication
CN112380552A (en) * 2020-11-20 2021-02-19 惠州Tcl移动通信有限公司 Data processing method and device, storage medium and computer equipment
CN112559991A (en) * 2020-12-21 2021-03-26 深圳市科力锐科技有限公司 System secure login method, device, equipment and storage medium
CN113766028A (en) * 2021-09-09 2021-12-07 图易(常熟)信息技术有限公司 Content copyright encryption traceability system and method based on cloud network
CN113938284A (en) * 2021-12-16 2022-01-14 佛山职业技术学院 Multi-connection encryption and decryption method, device and system based on gesture displacement

Similar Documents

Publication Publication Date Title
CN108512846B (en) Bidirectional authentication method and device between terminal and server
CN101043335A (en) Information security control system
CN110069918A (en) A kind of efficient double factor cross-domain authentication method based on block chain technology
CN112187931A (en) Session management method, device, computer equipment and storage medium
CN101827101A (en) Information asset protection method based on credible isolated operating environment
CN108055129B (en) A kind of method, equipment and system for realizing the unified management of cellphone shield key
CN107295024A (en) It is a kind of to realize the method that web front end is landed safely and accessed
CN111277607A (en) Communication tunnel module, application monitoring module and mobile terminal security access system
CN112235301B (en) Access right verification method and device and electronic equipment
CN115065469B (en) Data interaction method and device for power internet of things and storage medium
CN106911744A (en) The management method and managing device of a kind of image file
CN108347426B (en) Teaching system information security management system based on big data and access method
CN107645474A (en) Log in the method for open platform and log in the device of open platform
CN113037736A (en) Authentication method, device, system and computer storage medium
CN105871840B (en) A kind of certificate management method and system
CN105741444B (en) Application authentication method and device based on linux system financial self-service equipment
CN109474431A (en) Client certificate method and computer readable storage medium
CN107196957A (en) A kind of distributed identity authentication method and system
CN116842544A (en) Data security management method, data security management device and data security management system
CN105790935A (en) Independent-software-and-hardware-technology-based trusted authentication server
CN106097600B (en) Device management method, system and financial self-service equipment based on ATL
CN113676446B (en) Communication network safety error-proof control method, system, electronic equipment and medium
CN109859349A (en) A kind of entrance guard authentication method and system based on data SMS technology
CN212519015U (en) Local area network quantum communication center and system accessed to quantum secure communication network
CN111770100B (en) Method and system for verifying safe access of external equipment to Internet of things terminal

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination