WO2017020716A1

WO2017020716A1 - Method and device for data access control

Info

Publication number: WO2017020716A1
Application number: PCT/CN2016/090817
Authority: WO
Inventors: 原攀峰; 张维; 陈廷梁; 何召卫
Original assignee: 阿里巴巴集团控股有限公司; 原攀峰; 张维; 陈廷梁; 何召卫
Priority date: 2015-08-03
Filing date: 2016-07-21
Publication date: 2017-02-09
Also published as: CN106407832B; CN106407832A

Abstract

The aim of the present application is to provide a method and device for data access control. Specifically, the method comprises: acquiring input data, and generating output data according to the input data; acquiring an access control policy of the input data, wherein the access control policy of the input data is used for controlling an access permission of a device to the input data; and generating an access control policy of the output data according to the access control policy of the input data, wherein the access control policy of the output data is used for controlling an access permission of the device to the output data. Compared with the prior art, when output data is used for exchange, the output data is enabled to automatically obtain an access control policy of the output data itself according to upstream input data thereof, and the input data and the output data, between which an input-output relationship exists, are enabled to have certain consistency in transmissibility, thereby improving the security of data access control in a data exchange scenario.

Description

Method and device for data access control

Technical field

The present application relates to the field of communications and computers, and more particularly to a technique for data access control.

Background technique

In the context of the era of big data, the exchange of data has become an inevitable trend. Due to the data security requirements of the data provider and the characteristics of the specific data, in some scenarios, the data provider wants to be able to perform secure access control on the data exchanged, such as whether the data is allowed to be exported. In addition, the exchange of data is different from the general commodity exchange, with some obvious characteristics, such as the spread of data, which also brings new challenges to the security control of data. The method for performing security access control in the prior art is generally based on a scenario in which a closed environment (such as an internal private cloud of an enterprise) does not involve data exchange, and does not support data access control in a data exchange scenario, and The access control method adopted by the user generally uses some specific encryption algorithms to encrypt the data itself, and has little consideration for the widespread communication problems in the big data scenario.

Summary of the invention

An object of the present application is to provide a method and device for data access control to solve the problem that the data access control method in the prior art is not applicable to a data exchange scenario.

To achieve the above object, the present application provides a method for data access control, the method comprising:

Obtaining input data and generating output data according to the input data;

Acquiring an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data;

And generating, according to the access control policy of the input data, an access control policy of the output data, where the access control policy of the output data is used to control access authority of the device to the output data.

Further, obtaining input data includes:

Sending an authorization request for the input data to the data provider device, and after receiving the authorization information for the input data generated by the data provider device according to the authorization request, according to the authorization information, by the storage device Get the input data.

Further, the access control policy for obtaining the input data includes:

Sending a query request to the storage device, and receiving an access control policy of the input data sent by the storage device according to the query request.

Further, the access control policy for generating the output data according to the access control policy of the input data includes:

And generating, according to a mapping relationship between the input data and the output data, an access control policy of the output data by an access control policy of the input data according to a preset rule.

Further, the preset rule includes any one of the following:

Intersecting access rights in the access control policy of the input data as an access control policy of the output data; or

The access rights in the access control policy of the input data are summed as an access control policy of the output data.

Further, the access control policy of the input data includes a plurality of access rights for controlling the device to the input data, and the access control policy of the output data includes multiple access rights for controlling the device to the output data. ;

The preset rule includes any one of the following:

Intersecting multiple access rights in the access control policy of the input data as an access control policy of the output data; or

And collecting, by the plurality of access rights in the access control policy of the input data, as an access control policy of the output data.

Further, after the access control policy of the output data is generated according to the access control policy of the input data, the method further includes:

The output data and its corresponding access control policy are sent to the storage device.

Further, after the output data and the corresponding access control policy are sent to the storage device, the method further includes:

Receiving an authorization request for the input data from a data consumer device, generating authorization information for the input data according to the authorization request, and transmitting the authorization information to the data consumer device to make the data The consumer device acquires the output data by the storage device according to the authorization information.

According to another aspect of the present application, there is also provided an apparatus for data access control, the apparatus comprising:

a data generating device, configured to acquire input data, and generate output data according to the input data;

a policy obtaining device, configured to acquire an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data;

And a policy generating device, configured to generate, according to the access control policy of the input data, an access control policy of the output data, where the access control policy of the output data is used to control access authority of the device to the output data.

Further, the data generating apparatus is configured to send an authorization request for the input data to a data provider device, and receive an authorization for the input data generated by the data provider device according to the authorization request. After the information, the input data is acquired by the storage device according to the authorization information, and the output data is generated according to the input data.

Further, the policy obtaining means is configured to send a query request to the storage device, and receive an access control policy of the input data sent by the storage device according to the query request.

Further, the policy generating means is configured to generate, according to the mapping relationship between the input data and the output data, an access control policy of the output data by the access control policy of the input data according to a preset rule.

Further, the preset rule of the access control policy for generating the output data in the policy generating apparatus includes any one of the following:

The preset rule of the access control policy for generating the output data in the policy generating apparatus includes any one of the following:

Further, the device further includes:

And a sending device, configured to send the output data and its corresponding access control policy to the storage device after the access control policy of the output data is generated according to the access control policy of the input data.

Further, the device further includes:

And an authorization processing device, configured to: after transmitting the output data and its corresponding access control policy to the storage device, receive an authorization request for the output data from the data consumer device, and generate, according to the authorization request, the And outputting the authorization information of the data, and sending the authorization information to the data consumer device, so that the data consumer device acquires the output data by the storage device according to the authorization information.

Compared with the prior art, the technical solution provided by the present application generates output data according to the input data after acquiring input data, and then acquires an access control strategy of the input data, since the output data is generated according to the output data, thereby according to the input. The input and output relationship between data and output data, the access control strategy of the input data to generate an access control strategy for the output data, and when the output data is used for exchange, the output data can be automatically output according to the input data upstream thereof. The access control strategy of the data itself makes the input data and the output data of the input and output relationship have certain consistency in the propagation, and improves the security of the data access control in the data exchange scenario, and is applicable to the data exchange scenario.

DRAWINGS

Other features, objects, and advantages of the present application will become more apparent from the detailed description of the accompanying drawings.

FIG. 1 is a schematic structural diagram of an apparatus for data access control according to an embodiment of the present application;

2 is a schematic structural diagram of a device for data access control according to an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a device for data access control according to a preferred embodiment of the present disclosure;

4 is a flowchart of a method for data access control according to an embodiment of the present application;

FIG. 5 is a flowchart of a preferred method for data access control according to an embodiment of the present application;

FIG. 6 is a flowchart of a more preferred method for data access control according to an embodiment of the present application;

7 is a schematic structural diagram of a data transaction platform using a data access control method in an embodiment of the present application;

Figure 8 is a flow diagram of the interaction between a data provider and a data consumer in a data transaction platform.

The same or similar reference numerals in the drawings denote the same or similar components.

detailed description

The present application is further described in detail below with reference to the accompanying drawings.

In a typical configuration of the present application, the terminal, the device of the service network, and the trusted party each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium.

Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electricity Erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, A tape storage or other magnetic storage device or any other non-transportable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.

FIG. 1 shows an apparatus for data access control provided by an embodiment of the present application, where the apparatus 1 includes a data generating apparatus 110, a policy obtaining apparatus 120, and a policy generating apparatus 130. Specifically, the data generating apparatus 110 is configured to acquire input data, and generate output data according to the input data; the policy obtaining apparatus 120 is configured to acquire an access control policy of the input data, where the access control policy of the input data is used by Controlling the access authority of the device to the input data; the policy generating means 130 is configured to generate an access control policy of the output data according to the access control policy of the input data, wherein the access control policy of the output data is used for controlling The device's access to the output data. The input data and the output data have a mapping relationship between input and output. When the output data is used for exchange, the output data can automatically obtain an access control strategy of the output data according to the input data upstream thereof, so that there is an input-output relationship. The input data and the output data have a certain consistency in the propagation, and the security of the data access control in the data exchange scenario is improved, and is applicable to the data exchange scenario.

Here, the device 1 includes, but is not limited to, a network device, a user device, or a device in which a network device is integrated with a user device through a network. Here, the network device includes, but is not limited to, an implementation such as a network host, a single network server, a plurality of network server sets, or a cloud computing-based computer set; the user equipment may be a local user equipment running locally. Here, the cloud is composed of a large number of host or network servers based on Cloud Computing, which is a kind of distributed computing, a virtual computer composed of a group of loosely coupled computers.

In a certain data exchange application scenario, the user includes the data provider and the data consumer. For a certain user, the data provider and the data consumer can be used. Wherein, the data providing direction provides data to the user, and the data user can generate new data according to the obtained data, and obtain access control of the new data according to the input and output relationship between the data. System strategy. At this time, the device 1 is used as a data consumer device. If the data exchange between the data provider and the data consumer is implemented by the cloud computing platform, the device 1 may be a function for implementing data acquisition and processing functions in the cloud computing platform. A collection of servers or multiple servers. Here, those skilled in the art should be able to understand that the input data refers to source data provided by a data provider, and the output data refers to data generated according to input data. Input data and output data include, but are not limited to, data tables, user-defined functions, data services, and reports, etc., through the set access control policies, to control device access to these data. The access rights may be set according to specific application scenarios, such as whether they can be exported or the like. Here, the input data may be a plurality of different data acquired by a plurality of data providers, or may be data generated by the data consumer device itself, such as a data table purchased by the data provider, by the data provider. The data service purchased at, or the user-defined function generated by the data consumer device.

When the device 1 is a data consumer device, the data generating device 110 is configured to send an authorization request for the input data to a data provider device, and receive the data provider device according to the authorization request. After the generated authorization information for the input data, the input data is acquired by the storage device according to the authorization information, and the output data is generated according to the input data.

Here, the authorization request for the input data indicates that the device 1 as the data consumer desires to obtain the input data usage right request, and the corresponding authorization information indicates that the data provider device agrees that the data consumer uses the data. If the data is exchanged in the actual application scenario, the data provider puts the data to be sold on the data market provided by the cloud computing platform, so that the data user can know which data is currently available for purchase. The storage device may be a server or a collection of multiple servers in the cloud computing platform for implementing data storage processing functions, and data that is uploaded by the data provider in the data market is stored in the storage device. In the data exchange, the data consumer and the data provider do not directly exchange data. If the data user needs to obtain a certain shelf data, the data provider sends a purchase request to purchase the data (ie, For the authorization request), after receiving the purchase request, the data provider, if it agrees to the purchase, sends an approval message (that is, authorization information) to the data user to agree to the purchase, and the data user can agree according to the consent. The purchased approval information area requests the storage device for storing data in the cloud computing platform to obtain corresponding data, thereby completing Acquisition of data. Since the data provider and the data user exchange data by means of application and authorization, it is applicable to the application scenario of big data processing under the cloud computing platform, and the security of data transmission can be effectively controlled even if the data itself is not encrypted.

When the output data is generated according to the input data, different generation manners may be adopted according to the actual processing purpose of the data, including but not limited to: statistical analysis of the data (eg, ETL, Extract Transform Load, data extraction, conversion, loading), Or data mining, etc. For example, the input data is a data table purchased by the data provider A, statistically analyzing the data table, extracting some data in the data table, and then converting the data (for example, converting the data format). Then, the converted data is loaded into a new data table to generate a new data table (that is, output data). For another example, the input data includes a data table A, a data table B, and a data service C respectively purchased by the data providers A, B, and C, wherein the data table A is temperature data of a plurality of cities in the next few days, and data. Table B shows the rainfall probability data for the cities in the next few days. The data service C is a trend forecast for the sales of umbrellas based on the temperature and the probability of rain. Through the above data, the data table D can be generated. The data contained in the data table D is Forecast data on sales of umbrellas in several cities in the next few days. Here, those skilled in the art should understand that the above-mentioned manner of generating output data is only an example, and other existing or future possible manners, such as applicable to the present application, are also included in the scope of protection of the present application, and This is hereby incorporated by reference.

In the above application scenario, the access control policy of the input data may be stored independently of the input data. After the data generating device completes the generation of the output data, the policy obtaining device 120 sends a query request to the storage device, and receives the request. The access control policy of the input data sent by the storage device according to the query request. Taking the scenario of the data table A, the data table B, and the data service C to generate the data table D as an example, when the data table A, the data table B, and the data service C are racked, the data provider has submitted the access control policy of the data. In the server (ie, the storage device) for storing data in the cloud computing platform, after the data table D is generated, the policy obtaining device of the device 1 queries the storage device to obtain an access control policy of the input data.

Specifically, the policy generating apparatus 130 generates the output data according to the mapping relationship between the input data and the output data, and according to the preset rule by the access control policy of the input data. Access control strategy. Since the access control strategy of the output data is generated based on the mapping relationship between the input data and the output data, there is a certain continuity of access rights for the input data and the output data. In the above example, the input data corresponding to the data table D is the data table A, the data table B, and the data service C. The preset rules can be set according to the characteristics of the data and the business requirements. For example, the data table A contains more sensitive data. It is not suitable for the user to export and use. The access control policy is not allowed to be exported. Then, the strict control rule can be adopted: the access permission in the access control policy of the input data is intersected as the output data access. Control Strategy. At this time, even if the access control policy of the data table B and the data service C is allowed to be exported, the data table D is still not exportable. Of course, it is also possible to adopt a preset rule of loose control: that is, a union of access rights in an access control policy of input data as an access control strategy for output data. At this time, as long as one of the data table A, the data table B, and the data service C adopts the allowable export, the generated data table D is also allowed to be exported. Herein, those skilled in the art should understand that the above-mentioned preset rules are only examples, and other existing preset rules that may appear in the future may be applicable to the present application, and should also be included in the scope of protection of the present application. It is hereby incorporated by reference.

Depending on the application scenario, the access control policy of the input data includes a plurality of access rights for controlling the device to the input data, and the access control policy of the output data includes a plurality of control data for controlling the device. Access rights to suit the needs of different application scenarios. For example, in the scenario of the data transaction mentioned in the embodiment of the present application, the access rights included in the access control policy may include, but are not limited to, whether to allow the shelf, whether to allow the export, whether to allow access in the development environment, and the like. Wherein, allowing the shelf is means that the data provider can put the data in the data market, that is, the data and the data generated thereby can be authorized to the data consumer. The development environment refers to a private environment in which data is developed or analyzed internally by the data provider. Generally, in the case of data transaction, data is produced by each data provider, and the process of data production is a process of generating output data from input data. During the generation process, sample data may be extracted from data purchased by other data providers for related data development or analysis to generate output data. Allowing access in the development environment means that there is no restriction on the development or analysis of the data. The entire content of the data can be extracted as sample data. If access is not allowed in the development environment, the data cannot be directly obtained during development or analysis. Content can only be obtained in advance Development or analysis is performed based on the sample data extracted from the content of the data.

When the access control policy of the input data includes multiple access rights, the corresponding strict control preset rule and the loose control preset rule are separately classified: respectively, multiple access rights in the access control policy of the input data are respectively sought An intersection, as an access control policy of the output data; and a plurality of access rights in the access control policy of the input data, respectively, as an access control policy of the output data. Taking data table E, data table F, data table G, data table H, and data table I as an example, the mapping relationship between input and output is: (E, F, G) → (H, I), that is, by data table E ~G, generated two new data tables H, I. Assume that its access control policy is defined as follows: AP1, whether it is allowed to be on the shelf; AP2, whether to allow export; AP3, whether to allow access in the development environment, then

Data table E (AP1, AP2, AP3) = (1, 0, 0);

Data table F (AP1, AP2, AP3) = (1, 1, 0);

Data table G (AP1, AP2, AP3) = (1, 1, 1);

Then, according to the strict control preset rule, the access control policies of the generated data table H and data table I are: data table H, I (AP1, AP2, AP3) = (1, 0, 0) ∩ (1, 1, 0) ∩(1,1,1)=(1,0,0), which is only allowed on the shelf, and is not allowed to be exported and accessed in the development environment. Correspondingly, according to the preset rule of loose control, the access control policies of the generated data table H and data table I are: data table H, I (AP1, AP2, AP3) = (1, 0, 0) ∪ (1, 1,0)∪(1,1,1)=(1,1,1), which allows for shelves, allows export, and allows access in the development environment. By setting different preset rules and multiple different access rights, the granularity of data access control is finer, thus meeting the flexible and diverse access control requirements of the big data cloud computing platform.

Further, the embodiment of the present application further provides a preferred device 1 for data access control. Since the device 1 can also generate the output data and the access control policy of the output data, the device 1 can also be used as a data provider. The output data is put on the shelf and authorized for use by other data users, so that the technical solution is more suitable for the application scenario of data exchange of the cloud computing platform. The structure of the device 1 is as shown in FIG. 2, and includes a transmitting device 140 in addition to the data generating device 110, the policy obtaining device 120, and the policy generating device 130 shown in FIG. Specifically, the sending device 140 sends the output data and its corresponding access control policy to the storage device after generating an access control policy of the output data according to the access control policy of the input data. Ready. The content of the data generating device 110, the policy obtaining device 120, and the policy generating device 130 are the same as or substantially the same as those of the corresponding device in the embodiment of FIG. 1 for the sake of brevity, and therefore will not be described herein. And is included here by reference.

In the above application scenario, if both the data table H and the data table I generated by the device 1 are allowed to be on the shelf, the device 1 may send the data table H, the data table I and its corresponding access control policy to the storage device, so that the other The data consumer proposes to use the purchase request of data table H and data table I to complete the transaction of the data.

Further, the embodiment of the present application further provides a more preferred device 1 for data access control. The structure of the device 1 is as shown in FIG. 3, except for the data generating device 110 and the policy obtaining device 120 shown in FIG. In addition to the policy generating device 130 and the transmitting device 140, the authorization processing device 150 is further included to complete the approval of the authorization request made by other data consumers. Specifically, after the output processing data and the corresponding access control policy are sent to the storage device, the authorization processing device 150 receives an authorization request for the output data from the data consumer device, and generates a target for the authorization request according to the authorization request. Declaring authorization information of the output data, and transmitting the authorization information to the data consumer device, so that the data consumer device acquires the output data by the storage device according to the authorization information. Here, those skilled in the art should understand that the data generating device 110, the policy obtaining device 120, the policy generating device 130, and the transmitting device 140 are respectively the same or substantially the same as the corresponding devices in the embodiment of FIG. 2, and for the sake of brevity, This is not repeated here and is hereby incorporated by reference.

The content of the authorization request and the authorization information for the output data is substantially the same as the foregoing description of the authorization request for the input data and the authorization information, and the difference is only that the device 1 represents the data provider device at this time. After the output data is acquired by other data consumers, the input data for data generation by other data consumers is used. In the above application scenario, if the data consumer needs to purchase the data table H, the data provider receives the purchase request from the data table H, and if the purchase is agreed, the data user is sent a consent purchase. Approval information. The data provider and the data user exchange data by means of application and authorization. It is applicable to the application scenario of big data processing under the cloud computing platform. Even if the data itself is not encrypted, the security of data transmission can be effectively controlled.

Here, those skilled in the art should be able to understand that in the cloud computing platform, any user's The data processing operations can all be performed by a computer cluster within the cloud computing platform. For example, by using virtual machine technology, data processing operations performed by the data provider device and the data consumer device can be performed by a set of physical devices in the computer cluster that implement similar functions. Completion (eg, a server with data processing and transceiving functions), and the user's local device may only implement the functionality of accessing the application interface of the cloud computing platform.

FIG. 4 shows a method for data access control provided by an embodiment of the present application, the method comprising the following steps:

Step S401, acquiring input data, and generating output data according to the input data;

Step S402, acquiring an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data;

Step S403: Generate an access control policy of the output data according to the access control policy of the input data, where the access control policy of the output data is used to control access authority of the device to the output data.

Since the input data and the output data have a mapping relationship between input and output, when the output data is used for exchange, the output data can automatically obtain an access control strategy of the output data according to the input data upstream thereof, so that there is an input-output relationship. The input data and the output data have a certain consistency in the propagation, and the security of the data access control in the data exchange scenario is improved.

In a certain data exchange application scenario, the user includes the data provider and the data consumer. For a certain user, the data provider and the data consumer can be used. Wherein, the data providing direction data user provides data, and the data user can generate new data according to the obtained data, and obtain an access control strategy of the new data according to the input and output relationship between the data. Here, the foregoing execution body of the method for data access control is a data consumer device. If the data exchange between the data provider and the data consumer is implemented by the cloud computing platform, the data consumer device performing the above method may It is a collection of servers or servers used in the cloud computing platform to implement data acquisition and processing functions. Here, those skilled in the art should be able to understand that the input data refers to source data provided by a data provider, and the output data refers to data generated according to input data. Input data and output data include but are not limited to: data tables, user-defined functions, data services, and reports, etc. A policy to control access to the data, including the device. The access rights may be set according to specific application scenarios, such as whether they can be exported or the like. Here, the input data may be a plurality of different data acquired by a plurality of data providers, or may be data generated by the data consumer device itself, such as a data table purchased by the data provider, by the data provider. The data service purchased at, or the user-defined function generated by the data consumer device.

When the data is used as a data consumer, the input data is acquired in step S101, specifically, including: sending an authorization request for the input data to the data provider device, and receiving, according to the authorization request, the generated data provider device After the authorization information of the input data is received, the input data is acquired by the storage device according to the authorization information.

Here, the authorization request for the input data indicates that the data consumer wishes to obtain the input data usage right, and the corresponding authorization information indicates that the data provider agrees that the data consumer uses the data. If the data is exchanged in the actual application scenario, the data provider puts the data to be sold on the data market provided by the cloud computing platform, so that the data user can know which data is currently available for purchase. The storage device may be a server or a collection of multiple servers in the cloud computing platform for implementing data storage processing functions, and data that is uploaded by the data provider in the data market is stored in the storage device. In the data exchange, the data consumer and the data provider do not directly exchange data. If the data user needs to obtain a certain shelf data, the data provider sends a purchase request to purchase the data (ie, For the authorization request), after receiving the purchase request, the data provider, if it agrees to the purchase, sends an approval message (that is, authorization information) to the data user to agree to the purchase, and the data user can agree according to the consent. The purchased approval information area requests the storage device for storing data in the cloud computing platform to acquire corresponding data, thereby completing the acquisition of the data. Since the data provider and the data user exchange data by means of application and authorization, it is applicable to the application scenario of big data processing under the cloud computing platform, and the security of data transmission can be effectively controlled even if the data itself is not encrypted.

When the output data is generated according to the input data, different generation manners may be adopted according to the actual processing purpose of the data, including but not limited to: statistical analysis of the data (eg, ETL, Extract Transform Load, data extraction, conversion, loading), Or data mining, etc. For example, the input data is a data table purchased by the data provider A, the data The table performs statistical analysis, extracts some data in the data table, and then converts the data (for example, converts the data format), and then loads the converted data into a new data table to generate a new data. Table (that is, output data). For another example, the input data includes a data table A, a data table B, and a data service C respectively purchased by the data providers A, B, and C, wherein the data table A is temperature data of a plurality of cities in the next few days, and data. Table B shows the rainfall probability data for the cities in the next few days. The data service C is a trend forecast for the sales of umbrellas based on the temperature and the probability of rain. Through the above data, the data table D can be generated. The data contained in the data table D is Forecast data on sales of umbrellas in several cities in the next few days. Here, those skilled in the art should understand that the above-mentioned manner of generating output data is only an example, and other existing or future possible manners, such as applicable to the present application, are also included in the scope of protection of the present application, and This is hereby incorporated by reference.

In the above application scenario, the access control policy of the input data may be stored independently of the input data. After the generation of the output data is completed, the step S102 obtains the access control policy of the input data, which includes: to the storage device. Sending a query request, and receiving an access control policy of the input data sent by the storage device according to the query request. Taking the scenario of the data table A, the data table B, and the data service C to generate the data table D as an example, when the data table A, the data table B, and the data service C are racked, the data provider has submitted the access control policy of the data. To the server (ie, the storage device) for storing data in the cloud computing platform, after the data table D is generated, the storage device is queried to obtain an access control policy for the input data.

Specifically, the step S103 is configured to generate an access control policy of the output data according to the access control policy of the input data, including: according to a mapping relationship between the input data and the output data, and inputting the data according to a preset rule. The access control policy generates an access control policy for the output data. Since the access control strategy of the output data is generated based on the mapping relationship between the input data and the output data, there is a certain continuity of access rights for the input data and the output data. In the above example, the input data corresponding to the data table D is the data table A, the data table B, and the data service C. The preset rules can be set according to the characteristics of the data and the business requirements. For example, the data table A contains more sensitive data. It is not suitable for users to export and use. The access control policy is not allowed to export. Then you can use the strict control preset rule: The intersection of access rights in the data access control policy is used as an access control policy for output data. At this time, even if the access control policy of the data table B and the data service C is allowed to be exported, the data table D is still not exportable. Of course, it is also possible to adopt a preset rule of loose control: that is, a union of access rights in an access control policy of input data as an access control strategy for output data. At this time, as long as one of the data table A, the data table B, and the data service C adopts the allowable export, the generated data table D is also allowed to be exported. Herein, those skilled in the art should understand that the above-mentioned preset rules are only examples, and other existing preset rules that may appear in the future may be applicable to the present application, and should also be included in the scope of protection of the present application. It is hereby incorporated by reference.

Depending on the application scenario, the access control policy of the input data includes a plurality of access rights for controlling the device to the input data, and the access control policy of the output data includes a plurality of control data for controlling the device. Access rights to suit the needs of different application scenarios. For example, in the scenario of the data transaction mentioned in the embodiment of the present application, the access rights included in the access control policy may include, but are not limited to, whether to allow the shelf, whether to allow the export, whether to allow access in the development environment, and the like. Wherein, allowing the shelf is means that the data provider can put the data in the data market, that is, the data and the data generated thereby can be authorized to the data consumer. The development environment refers to a private environment in which data is developed or analyzed internally by the data provider. Generally, in the case of data transaction, data is produced by each data provider, and the process of data production is a process of generating output data from input data. During the generation process, sample data may be extracted from data purchased by other data providers for related data development or analysis to generate output data. Allowing access in the development environment means that there is no restriction on the development or analysis of the data. The entire content of the data can be extracted as sample data. If access is not allowed in the development environment, the data cannot be directly obtained during development or analysis. The content can only be obtained by sampling data extracted in advance based on the content of the data for development or analysis.

When the access control policy of the input data includes multiple access rights, the corresponding strict control preset rule and the loose control preset rule are separately classified: respectively, multiple access rights in the access control policy of the input data are respectively sought An intersection, as an access control policy of the output data; and a plurality of access rights in the access control policy of the input data, respectively, as an access control policy of the output data. Data table E, data table F, data table G, data table H, The data table I is an example, and the mapping relationship between the input and output is: (E, F, G) → (H, I), that is, two new data tables H and I are generated from the data tables E to G. Assume that its access control policy is defined as follows: AP1, whether it is allowed to be on the shelf; AP2, whether to allow export; AP3, whether to allow access in the development environment, then

Data table E (AP1, AP2, AP3) = (1, 0, 0);

Data table F (AP1, AP2, AP3) = (1, 1, 0);

Data table G (AP1, AP2, AP3) = (1, 1, 1);

Further, the embodiment of the present application further provides a preferred method for data access control. If a user uses the method to generate output data and an access control policy for outputting data, the method may also serve as a data provider. The output data of the production is put on the shelf and authorized for use by other data users, so that the technical solution is more suitable for the application scenario of data exchange of the cloud computing platform. Thus, the processing flow of the method is as shown in FIG. 5, and includes the following steps:

Step S501, acquiring input data, and generating output data according to the input data;

Step S502: Acquire an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data.

Step S503, generating an access control policy of the output data according to the access control policy of the input data, where the access control policy of the output data is used to control access authority of the device to the output data;

Step S504, the output data and its corresponding access control policy are sent to the storage device.

For example, in the above application scenario, if both the generated data table H and the data table I are allowed to be put on the shelf, Then the user can send the data table H, the data table I and its corresponding access control policy to the storage device, so that other data consumers propose to use the purchase request of the data table H and the data table I to complete the transaction of the data.

Further, the embodiment of the present application further provides a more preferred method for data access control. The processing flow of the method is as shown in FIG. 6, and includes the following steps:

Step S601, acquiring input data, and generating output data according to the input data;

Step S602: Acquire an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data.

Step S603, generating an access control policy of the output data according to the access control policy of the input data, where the access control policy of the output data is used to control access authority of the device to the output data;

Step S604, the output data and its corresponding access control policy are sent to the storage device;

Step S605, receiving an authorization request for the output data from the data consumer device, generating authorization information for the output data according to the authorization request, and transmitting the authorization information to the data consumer device, so that The data consumer device acquires the output data by the storage device according to the authorization information.

The authorization request and authorization information for the output data are substantially the same as the foregoing content of the authorization request for the input data and the authorization information, except that the execution body of the method is provided as data when performing step S605. The square device, after the output data is acquired by other data consumers, is used as input data for data generation by other data consumers. In the above application scenario, if the data consumer needs to purchase the data table H, the data provider receives the purchase request from the data table H, and if the purchase is agreed, the data user is sent a consent purchase. Approval information. The data provider and the data user exchange data by means of application and authorization. It is applicable to the application scenario of big data processing under the cloud computing platform. Even if the data itself is not encrypted, the security of data transmission can be effectively controlled.

Here, those skilled in the art should be able to understand that in the cloud computing platform, any user's data processing operations can be completed by a computer cluster within the cloud computing platform, such as using virtual machine technology, data provider devices, and data consumer devices. The data processing operations performed can be performed by The collection of physical devices implementing similar functions within the computer cluster is completed (for example, a server having data processing and transceiving functions), and the local device of the user may only implement the function of accessing the application interface of the cloud computing platform.

FIG. 7 shows a data transaction platform in a cloud computing environment using the above data access control method. The functional framework of the platform is as shown in FIG. 7 and includes the following functional modules: a database module 710, a data exchange publishing module 720, The data processing task module 730, the real-time blood edge collection module 740, the security access control module 750, the access control policy query module 760, the database module 710, the data exchange publishing module 720, the data processing task module 730, the real-time blood edge collection module 740, and the security access control Module 750 and access control policy query module 760. In the above functional module, the database module 710 is used to implement the related functions of the foregoing storage device, and the remaining functional modules are used to implement the corresponding functions of the device 1 when it is used as a data consumer device or a data provider device, and the specific implementation may be A computer or cluster of computers that implement specific functions in a cloud computing platform. For a certain user, when the data provider or the data consumer uses the data transaction platform to implement data transaction and perform data access control, the application interface provided by the user local device (for example, a local computer, a mobile terminal, etc.) can be used to access the cloud. A computer or computer cluster that implements a specific function in the computing platform to implement the related functions of the above functional modules.

Specifically, the database module 710 is configured to save the transaction data, the access control policy corresponding to the transaction data, and the running data generated by other functional modules during the running process. In the cloud computing environment, the database module may adopt a distributed database. The transaction data is data exchanged between the data provider and the data consumer, and the transaction data purchased by the user is the aforementioned input data, and the transaction data generated by the user and exchanged on the shelf is For the aforementioned output data.

The data exchange issuing module 720 is configured to issue data for data exchange, set an access control policy of the transaction data, so that the transaction data is put on the shelf, can be purchased by other users, and issue transaction data to the data user according to the authorization information.

The data processing task module 730 is configured to process the data obtained by the exchange, that is, the output data is generated according to the input data in the foregoing method. Since the manner of generating in general can be preset by the program, the data processing processing task can be performed by the workflow. Schedule periodic execution.

The real-time blood collection module 740 is configured to collect the blood relationship after the data processing is completed. The blood relationship indicates the mapping relationship between the input data and the output data, that is, which data is generated by which data.

The security access control module 750 is configured to obtain a mapping relationship between the input data and the output data by parsing the blood relationship, and then query the access control policy of the input data, and according to the mapping relationship between the input data and the output data and the access of the input data. Control strategy, an access control policy that calculates output data. The rules for calculating the access control policy of the output data have been mentioned in the foregoing section, and are not described herein again.

The access control policy query module 760 provides an external application program interface, so that when using the transaction data, the user can query the access control policy of the data through the application program interface, and perform security access control of the data according to the access control policy to ensure that the data is transmitted. Security in the process.

FIG. 8 shows an interaction flowchart of a data transaction platform in which the user uses the aforementioned cloud computing environment, and two users interacting as a data provider and a data consumer respectively.

For data providers, the processing flow includes:

Step S801, selecting data to be put on the shelf, for example, selecting a data table to be published to the data market.

Step S802, determining an access control policy of the data, and then submitting and storing the data to the database module 710 of the cloud computing platform through the data exchange publishing module 720.

In step S803, data exchange is performed.

For the data provider, the data exchange step is specifically: waiting for the data user's purchase application, and after receiving the purchase application, the approval may be performed to agree to the data user to obtain the data.

For data consumers, the processing flow includes:

In step S803, data exchange is performed.

For the data consumer, the data exchange step is specifically: after the data in the data market is found to be purchased, the purchase request is sent to the data provider, and after receiving the approval of the data provider to agree to the purchase, the cloud computing The database module 710 of the platform acquires the data.

In step S804, data is obtained by using the exchange as input data, and data processing processing is performed by the data processing task module 730 to generate new output data.

In step S805, the blood relationship of the data is collected by the blood collection module 740.

Step S806, the blood relationship is analyzed by the security access control module 750, and a mapping relationship between the input data and the output data is obtained.

Step S807, the access control policy query module 760 queries the access control policy of the input data from the cloud computing platform.

Step S808, the access control policy for output data is calculated according to the preset rule by the security access control module 750, for example, according to the strict control preset rule, the access authority in the access control policy of the input data is collected and combined as The access control policy of the output data.

Step S809, the access control policy of the output data is stored in the database module 710 of the cloud computing platform, and is used by the user who needs to use the data through the application program interface.

In summary, the technical solution provided by the present application generates output data according to the input data after acquiring input data, and then acquires an access control policy of the input data, since the output data is generated according to the output data, thereby according to the input data and The input and output relationship between the output data, the access control strategy of the input data to generate an access control strategy for the output data, and when the output data is used for exchange, the output data can automatically obtain the output data according to the input data upstream thereof. The access control strategy makes the input data and the output data of the input-output relationship have certain consistency in the propagation, and improves the security of the data access control in the data exchange scenario. In addition, by setting different preset rules and multiple different access rights, the granularity of data access control is finer, thus meeting the flexible and diverse access control requirements of the big data cloud computing platform.

It should be noted that the present application can be implemented in software and/or a combination of software and hardware, for example, using an application specific integrated circuit (ASIC), a general purpose computer, or any other similar hardware device. In one embodiment, the software program of the present application can be executed by a processor to implement the steps or functions described above. Likewise, the software programs (including related data structures) of the present application can be stored in a computer readable recording medium such as a RAM memory, a magnetic or optical drive or a floppy disk and the like. In addition, some of the steps or functions of the present application may be implemented in hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.

In addition, a portion of the application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can be invoked or provided by the operation of the computer The method and/or technical solution of the present application. The program instructions for invoking the method of the present application may be stored in a fixed or removable recording medium, and/or transmitted by a data stream in a broadcast or other signal bearing medium, and/or stored in a The working memory of the computer device in which the program instructions are run. Herein, an embodiment in accordance with the present application includes a device including a memory for storing computer program instructions and a processor for executing program instructions, wherein when the computer program instructions are executed by the processor, triggering The apparatus operates based on the aforementioned methods and/or technical solutions in accordance with various embodiments of the present application.

It is obvious to those skilled in the art that the present application is not limited to the details of the above-described exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the invention is defined by the appended claims instead All changes in the meaning and scope of equivalent elements are included in this application. Any reference signs in the claims should not be construed as limiting the claim. In addition, it is to be understood that the word "comprising" does not exclude other elements or steps. A plurality of units or devices recited in the device claims may also be implemented by a unit or device by software or hardware.

Claims

A method for data access control, wherein the method comprises:

Obtaining input data and generating output data according to the input data;

Acquiring an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data;

And generating, according to the access control policy of the input data, an access control policy of the output data, where the access control policy of the output data is used to control access authority of the device to the output data.
The method of claim 1 wherein obtaining input data comprises:

Sending an authorization request for the input data to the data provider device, and after receiving the authorization information for the input data generated by the data provider device according to the authorization request, according to the authorization information, by the storage device Get the input data.
The method of claim 2, wherein the obtaining an access control policy of the input data comprises:

Sending a query request to the storage device, and receiving an access control policy of the input data sent by the storage device according to the query request.
The method according to any one of claims 1 to 3, wherein the access control policy for generating the output data according to the access control policy of the input data comprises:

And generating, according to a mapping relationship between the input data and the output data, an access control policy of the output data by an access control policy of the input data according to a preset rule.
The method of claim 4, wherein the preset rule comprises any one of the following:

Intersecting access rights in the access control policy of the input data as an access control policy of the output data; or

The access rights in the access control policy of the input data are summed as an access control policy of the output data.
The method according to claim 4 or 5, wherein the access control policy of the input data comprises a plurality of access rights for controlling the device to the input data, and the access control policy of the output data comprises a control device Multiple access rights to the output data;

The preset rule includes any one of the following:

Intersecting multiple access rights in the access control policy of the input data as an access control policy of the output data; or

And collecting, by the plurality of access rights in the access control policy of the input data, as an access control policy of the output data.
The method according to any one of claims 1 to 6, wherein after the access control policy of the output data is generated according to the access control policy of the input data, the method further includes:

The output data and its corresponding access control policy are sent to the storage device.
The method of claim 7, wherein after the output data and the corresponding access control policy are sent to the storage device, the method further includes:

Receiving an authorization request for the input data from a data consumer device, generating authorization information for the input data according to the authorization request, and transmitting the authorization information to the data consumer device to make the data The consumer device acquires the output data by the storage device according to the authorization information.
A device for data access control, wherein the device comprises:

a data generating device, configured to acquire input data, and generate output data according to the input data;

a policy obtaining device, configured to acquire an access control policy of the input data, where the access control policy of the input data is used to control access authority of the device to the input data;

And a policy generating device, configured to generate, according to the access control policy of the input data, an access control policy of the output data, where the access control policy of the output data is used to control access authority of the device to the output data.
The device according to claim 9, wherein the data generating means is configured to send an authorization request for the input data to a data provider device, and generate the data provider device according to the authorization request After the authorization information for the input data, the input data is acquired by the storage device according to the authorization information, and the output data is generated according to the input data.
The device according to claim 10, wherein the policy obtaining means is configured to send a query request to the storage device, and receive the storage device to send according to the query request The access control policy of the input data.
The device according to any one of claims 9 to 11, wherein the policy generating means is configured to control the access of the input data according to a mapping relationship between the input data and the output data according to a preset rule. The policy generates an access control policy for the output data.
The device according to claim 12, wherein the preset rule of the access control policy for generating the output data in the policy generating device comprises any one of the following:

Intersecting access rights in the access control policy of the input data as an access control policy of the output data; or

The access rights in the access control policy of the input data are summed as an access control policy of the output data.
The device according to claim 12 or 13, wherein the access control policy of the input data comprises a plurality of access rights for controlling the device to the input data, and the access control policy of the output data comprises a control device Multiple access rights to the output data;

The preset rule of the access control policy for generating the output data in the policy generating apparatus includes any one of the following:

Intersecting multiple access rights in the access control policy of the input data as an access control policy of the output data; or

And collecting, by the plurality of access rights in the access control policy of the input data, as an access control policy of the output data.
The device according to any one of claims 9 to 14, wherein the device further comprises:

And a sending device, configured to send the output data and its corresponding access control policy to the storage device after the access control policy of the output data is generated according to the access control policy of the input data.
The device of claim 15, wherein the device further comprises:

And an authorization processing device, configured to: after transmitting the output data and its corresponding access control policy to the storage device, receive an authorization request for the output data from the data consumer device, and generate, according to the authorization request, the And outputting the authorization information of the data, and sending the authorization information to the data consumer device, so that the data consumer device acquires the output data by the storage device according to the authorization information.