WO2019119304A1 - 一种数据文件及其访问方法、装置及设备 - Google Patents

一种数据文件及其访问方法、装置及设备 Download PDF

Info

Publication number
WO2019119304A1
WO2019119304A1 PCT/CN2017/117511 CN2017117511W WO2019119304A1 WO 2019119304 A1 WO2019119304 A1 WO 2019119304A1 CN 2017117511 W CN2017117511 W CN 2017117511W WO 2019119304 A1 WO2019119304 A1 WO 2019119304A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
access
file
data file
metadata
Prior art date
Application number
PCT/CN2017/117511
Other languages
English (en)
French (fr)
Inventor
胡希平
韩问寒
张佳
王飞
程俊
Original Assignee
中国科学院深圳先进技术研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院深圳先进技术研究院 filed Critical 中国科学院深圳先进技术研究院
Priority to PCT/CN2017/117511 priority Critical patent/WO2019119304A1/zh
Publication of WO2019119304A1 publication Critical patent/WO2019119304A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules

Definitions

  • This solution belongs to the field of data security, and in particular relates to a data file and a method, device and device for accessing the same.
  • Sensitive data is very common.
  • the consumer's name, account information, and various data forms such as documents, service work order descriptions, reports, and the like.
  • it is easy to cause leakage of sensitive data.
  • the embodiment of the present invention provides a method, a device, and a device for accessing sensitive data, so as to solve the problem of data inconsistency, loss of data operation flexibility, or loss of control over data in the prior art.
  • the problem of permission to get data is not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to get data.
  • a first aspect of an embodiment of the present solution provides a data file, the data file including a source file and metadata, wherein:
  • the metadata includes a metadata table for recording a storage location of sensitive data in the source file, and according to
  • the metadata table includes one or more tuples, where the tuple records offsets of sensitive data and lengths of sensitive data.
  • the access policy selects one or more tuples in the metadata according to the user's rights.
  • the data file is stored in an encrypted manner on a file server, and an access record of the user access data file is recorded through an access table in the file server.
  • a second aspect of the embodiment of the present invention provides a method for accessing a data file, where the access method of the data file includes:
  • Controlling access by the user to the data file is performed according to the access policy.
  • the step of controlling the user access to the data file according to the access policy includes:
  • the method further includes:
  • the data file after the data is written is compared with the data file before the data is written, and the newly written data information is obtained;
  • the newly written data information is recorded in the metadata corresponding to the data file.
  • the data file is stored in a central file server, and the access method of the data file further includes:
  • a third aspect of the embodiment of the present invention provides an access device for a data file, where the access device of the data file includes:
  • a metadata acquiring unit configured to receive a read instruction of the file data, and acquire metadata corresponding to the file data, where the metadata is used to mark a storage location of the sensitive data in the data file and an access policy;
  • An access policy searching unit is configured to search for an access policy corresponding to the user according to the acquired metadata, where the access policy is generated according to the user's access rights to the sensitive data;
  • an access control unit configured to control access by the user to the data file according to the access policy.
  • a fourth aspect of the embodiments of the present invention provides an access device for a data file, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, wherein the processing The step of implementing the access method of the data file according to any one of the second aspects when the computer program is executed.
  • a fourth aspect of the embodiments of the present invention provides a computer readable storage medium storing a computer program, the computer program being executed by a processor to implement the data according to any one of the second aspects The steps of the file access method.
  • FIG. 1 is a schematic structural diagram of a data file provided by an embodiment of the present solution
  • FIG. 2 is a schematic diagram of a representation of a data file provided by an embodiment of the present solution
  • FIG. 3 is a schematic flowchart of an implementation method of a data file access method provided by an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of an access device for a data file provided by an embodiment of the present solution
  • FIG. 5 is a schematic structural diagram of a data encryption mechanism provided by an embodiment of the present disclosure.
  • FIG. 6 is a schematic diagram of an access device of a data file provided by an embodiment of the present solution.
  • FIG. 1 is a schematic structural diagram of a data file according to an embodiment of the present disclosure.
  • the data file includes a source file, and the source file may be a file in a different format.
  • the source file may be a WORD file, a POWERPOINT file, a TXT file, or the like.
  • One or more sensitive data may be included in the source file.
  • the sensitive data may be user privacy data in the data file, and the sensitive data may be determined by the system automatically according to the characteristic keyword of the sensitive data or the type of the data, or may be specified by the user.
  • the data file further includes metadata bound to the source file, where the metadata is used to record a storage location of the sensitive data in the source file, as shown in FIG. 1, the metadata includes a metadata table.
  • the storage location of the sensitive data may be recorded in the metadata table.
  • the storage location of the sensitive data can be represented by the offset of the sensitive data and the length of the sensitive data.
  • the storage address of the start position of the sensitive data may be determined by the offset of the sensitive data, and the storage of the end position of the sensitive data may be determined according to the offset of the sensitive data and the length of the sensitive data. address.
  • the storage address of the sensitive data can be determined according to the storage address of the start location and the storage address of the end location.
  • Each data file can be associated with one or more metadata, and the metadata records the byte position of the sensitive data through a metadata table, so that sensitive data can be protected at the byte level.
  • the metadata table may include a plurality of tuples, each tuple may mark a storage address of sensitive data, and the number of the tuples may correspond to the number of the sensitive data. As shown in FIG. 1, the tuple may include an ID number and a tagged storage address. When the access policy is generated, the selected sensitive data can be determined by the selection of the ID number. As shown in FIG.
  • user 1 corresponds to an access policy generated by tuple 1 (ID1) and tuple 3 (ID3) in the selected metadata table
  • user 2 corresponds to tuple 1 in the selected metadata table
  • ID2 and the access policy generated by tuple 3 (ID3).
  • An access policy group can be generated by multiple user access policies. Different access policy groups can associate the same source file through different metadata. When users access data in the group, the rights management is performed through the corresponding metadata table. Therefore, in the process of data sharing, it is not necessary to generate a copy of the file, and it is not necessary to modify the source file, thereby ensuring the controllability of the sharing process and the consistency of the data. Fine-grained markup at the byte level makes permission access more flexible, enabling dynamic management of different users, and more comprehensive protection of complex and sensitive data embedded in files.
  • Metadata records the offset of sporadic sensitive data in the data file, the length of sensitive data, and the access rights of sensitive data, so that when the application reads the file, the corresponding conversion operation will occur.
  • the system will read the metadata bound to the source file in the data file, and query whether the user has access to the sensitive data according to the access policy in the metadata.
  • the permission may be a permission of the system account, or an authority of the application, or a right corresponding to the account of the application.
  • the rights may also stipulate in the access policy the universal access rights of any user receiving the data file.
  • the access policy detects that the user has access to sensitive data, the user can be authorized to have access rights.
  • the sensitive data is skipped, other non-sensitive data after the sensitive data is accessed, or other sensitive data with access rights is accessed.
  • the records in the data written to the data file can be marked in the metadata.
  • the data file after the data is written is compared with the data file before the data is written (the data file of the previous version), the location of the write data is recorded, or the length of the write data may be recorded, or It may include a storage location of sensitive data in which data is written, and the like.
  • the representation of the sensitive data of the data file in the system is divided into an application layer, a file system layer, and a hardware layer representation, as shown in FIG. 2, and the layers are respectively described as follows:
  • the sensitive data is highlighted in a graphical manner, that is, in the graphical interface, the sensitive data is highlighted, so that the user or the administrator can understand the structure of the data.
  • the virtual address of the source file and the metadata is represented.
  • the data file and the metadata are associated and converted into a file buffer address, and the source file and the metadata of the data file are stored in a continuous Virtual address, read out the write together.
  • both source files and metadata are stored on disk as byte data, and there is no logical association.
  • FIG. 3 is a schematic flowchart of an implementation method of a data file access method according to an embodiment of the present disclosure, which is as follows:
  • step S301 receiving a read instruction of the file data, and acquiring metadata corresponding to the file data, where the metadata is used to mark a storage location of the sensitive data in the data file and an access policy;
  • the metadata is substantially the same as the metadata described in FIG. 1, the metadata includes a metadata table that marks a storage address of the sensitive data, and is used to determine whether the user has sensitive data marked on the metadata table. Access policy for access rights.
  • the access policy can be dynamically assigned to different users as needed, and the access policy is used to control the user's access to the data file.
  • the access policy is only necessary to dynamically adjust the metadata in the data file, without generating a copy of the file, or modifying the source file, thereby realizing dynamic management of different users, and
  • the protection of complex and sensitive data embedded in files is also more comprehensive.
  • step S302 the access policy corresponding to the user is searched according to the acquired metadata, and the access policy is generated according to the access authority of the user to the sensitive data;
  • the access policy corresponds to the user, and different access policies can be dynamically generated according to different users, thereby implementing flexible control of access rights of data files.
  • the ID and authority information of the sensitive data may be recorded, and the corresponding relationship between the ID of the sensitive data and the storage address of the sensitive data is recorded in the metadata table.
  • the storage address of the sensitive data may include an offset address of the sensitive data and a length of the sensitive data.
  • the ID of the sensitive data is recorded in the metadata table. Therefore, the storage address of the sensitive data can be found in the metadata table according to the ID in the access policy, so that the storage address can be determined to be stored. Whether sensitive data has access rights.
  • step S303 the user access to the data file is controlled according to the access policy.
  • the authorization for accessing the sensitive data may be obtained, if the detecting user does not have the access to the sensitive data. Permissions, skip this sensitive data.
  • data when accessing the data file, data may also be written to the data file by an application.
  • data When data is written, it can be compared with the data file of the previous version, and the location where the data is written is recorded by the metadata. Therefore, through the recording of metadata, it is possible to ensure the consistency of the data during the sharing process of the data file.
  • FIG. 4 is a schematic diagram of interaction between the data file and the file system of the terminal when the data file is stored in the central file server.
  • the input and output of the data file between the central file server and the file system of the terminal are implemented by encryption, which can protect the privacy of the user's access operation.
  • two tables may be stored in the central file server, including an access table and a block table, wherein the access table records a user ID of the access data file, an ID of the accessed data file, and a The data block ID in the data file in which the data file ID, the data block ID in the data file, and the specific source file are recorded.
  • the access table records a user ID of the access data file, an ID of the accessed data file, and a The data block ID in the data file in which the data file ID, the data block ID in the data file, and the specific source file are recorded.
  • the central file server and the file system of the terminal perform input and output operations in units of blocks, which is advantageous for improving read and write performance and reducing disk fragmentation.
  • FIG. 5 is a schematic structural diagram of a data file accessing apparatus according to an embodiment of the present disclosure, where the data file accessing apparatus includes:
  • the metadata obtaining unit 501 is configured to receive a read instruction of the file data, and obtain metadata corresponding to the file data, where the metadata is used to mark a storage location of the sensitive data in the data file and an access policy;
  • the access policy searching unit 502 is configured to search for an access policy corresponding to the user according to the acquired metadata, where the access policy is generated according to the user's access rights to the sensitive data.
  • the access control unit 503 is configured to control access by the user to the data file according to the access policy.
  • the access control unit comprises:
  • Reading a subunit configured to start reading sensitive data in the data file when the access policy allows a user to access sensitive data in the data file;
  • the subunit is skipped for skipping access to the sensitive data when the access policy does not allow sensitive data in the data file by the user.
  • the device further comprises:
  • a write data information obtaining unit configured to compare the data file after the data is written with the data file before the data is written, and obtain the newly written data information when the data is written in the data file;
  • a recording unit configured to record the newly written data information in the metadata corresponding to the data file.
  • the data file is stored in a central file server, and the access device of the data file further includes:
  • a request receiving unit configured to receive an encrypted access request sent by the terminal, record the user of the access request, and the accessed file information
  • a data file sending unit configured to search for a corresponding data file according to the access request, and send the data file to the terminal.
  • the access device of the data file shown in FIG. 5 corresponds to the access method of the data file described in FIG.
  • FIG. 6 is a schematic diagram of an access device of a data file according to an embodiment of the present disclosure.
  • the access device 6 of the data file of this embodiment includes a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and operable on the processor 60, such as a data file. Access program.
  • the processor 60 executes the computer program 62 to implement the steps in the foregoing method for accessing each data file, such as steps 301 to 303 shown in FIG.
  • the processor 60 executes the computer program 62, the functions of the modules/units in the foregoing device embodiments are implemented, such as the functions of the modules 501 to 503 shown in FIG.
  • the computer program 62 can be partitioned into one or more modules/units that are stored in the memory 61 and executed by the processor 60 to complete This program.
  • the one or more modules/units may be a series of computer program instruction segments capable of performing a particular function, the instruction segments being used to describe the execution of the computer program 62 in the access device 6 of the data file.
  • the computer program 62 can be divided into a metadata acquisition unit, an access policy search unit, and an access control unit, and the specific functions of each unit are as follows:
  • a metadata acquiring unit configured to receive a read instruction of the file data, and acquire metadata corresponding to the file data, where the metadata is used to mark a storage location of the sensitive data in the data file and an access policy;
  • An access policy searching unit is configured to search for an access policy corresponding to the user according to the acquired metadata, where the access policy is generated according to the user's access rights to the sensitive data;
  • an access control unit configured to control access by the user to the data file according to the access policy.
  • the access device 6 of the data file may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the access device of the data file may include, but is not limited to, a processor 60, a memory 61. It will be understood by those skilled in the art that FIG. 6 is only an example of the access device 6 of the data file, does not constitute a limitation of the access device 6 of the data file, may include more or less components than the illustration, or combine some
  • the components, or different components, such as the access device of the data file may also include input and output devices, network access devices, buses, and the like.
  • the so-called processor 60 can be a central processing unit (Central Processing Unit, CPU), can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 61 may be an internal storage unit of the access device 6 of the data file, such as a hard disk or memory of the access device 6 of the data file.
  • the memory 61 may also be an external storage device of the access device 6 of the data file, such as a plug-in hard disk equipped on the access device 6 of the data file, a smart memory card (SMC), and a secure digital device. (Secure Digital, SD) card, flash card (Flash Card) and so on.
  • the memory 61 may also include an internal storage unit of the access device 6 of the data file and an external storage device.
  • the memory 61 is used to store the computer program and other programs and data required by the access device of the data file.
  • the memory 61 can also be used to temporarily store data that has been output or is about to be output.
  • each functional unit and module described above is exemplified. In practical applications, the above functions may be assigned to different functional units as needed.
  • the module is completed by dividing the internal structure of the device into different functional units or modules to perform all or part of the functions described above.
  • Each functional unit and module in the embodiment may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit, and the integrated unit may be hardware.
  • Formal implementation can also be implemented in the form of software functional units.
  • the specific names of the respective functional units and modules are only for the purpose of facilitating mutual differentiation, and are not intended to limit the scope of protection of the present application.
  • For the specific working process of the unit and the module in the foregoing system reference may be made to the corresponding process in the foregoing method embodiment, and details are not described herein again.
  • the disclosed device/terminal device and method may be implemented in other manners.
  • the device/terminal device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units.
  • components may be combined or integrated into another system, or some features may be omitted or not performed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present solution may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated modules/units if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the present solution implements all or part of the processes in the foregoing embodiment, and may also be completed by a computer program to instruct related hardware.
  • the computer program may be stored in a computer readable storage medium. The steps of the various method embodiments described above may be implemented when the program is executed by the processor. .
  • the computer program comprises computer program code, which may be in the form of source code, object code form, executable file or some intermediate form.
  • the computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard drive, a magnetic disk, an optical disk, a computer memory, a read only memory (ROM, Read-Only) Memory), random access memory (RAM, Random) Access Memory), electrical carrier signals, telecommunications signals, and software distribution media.
  • ROM Read Only memory
  • RAM Random Access Memory
  • electrical carrier signals telecommunications signals
  • telecommunications signals and software distribution media. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer readable media It does not include electrical carrier signals and telecommunication signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据文件包括源文件和元数据，其中：在所述源文件中包括有一个或者多个敏感数据；所述元数据包括用于记录所述源文件中的敏感数据的存储位置的元数据表，以及根据所述元数据表与敏感数据的存储位置的对应关系，结合用户对所述敏感数据的访问权限生成的访问策略。当不同的用户访问所述数据文件中的敏感数据时，只需要根据数据文件中的访问策略即可控制用户对敏感数据的访问，不需要对所述数据文件进行删除等修改，保证了分享过程中的可控制性和数据的一致性，可以根据所述访问策略有效的对数据文件进行控制。

Description

一种数据文件及其访问方法、装置及设备 技术领域
本方案属于数据安全领域，尤其涉及一种数据文件及其访问方法、装置及设备。
 背景技术
随着移动互联网、智能硬件、传感器的发展，数据量越来越多，各个公司搜集的个人数据安全无法得到保障，数据泄露、买卖的事件层出不穷，已经对普通人的正常生活造成了巨大的影响。在个人逐渐被数据化的时代，国家开始立法管制，16年底颁布的《中华人民共和国网络安全法》对数据采集、使用都有明确的规定。立法一定程度上对个人数据的使用进行了限制，但是在数据平台上对敏感数据的保护的技术还有待提高，因为在进行数据共享时，也极有可能因为技术本身的缺陷造成敏感数据的泄露或者数据共享不便。
在现在的云服务环境，尤其是PaaS（英文全称为Platform-as-a-Service，中文全称为平台即服务）或SaaS（英文全称为Software-as-a-service，中文全称为软件即服务）中，敏感数据是非常常见的。例如消费者的姓名、账户信息以及各种各样的数据形式例如文档、服务工单描述、报告等等。在服务提供的过程中，即使可能并不是故意为之，也很容易造成敏感数据的泄露。
在隐私数据保护领域，最新的方案仅仅将数据保护推进到了文件级别（对于非结构化数据）或数据表级别（对于结构化数据库）。在这样的粗粒度下，数据的一致性将很难维护，因为数据源平台为了保护敏感数据，可能直接将其删除后再把数据分享给其他平台，这就造成了数据不一致。而为了达到更细的粒度，现有的方法是强行在数据库中将数据拆分到多个不同访问权限的数据表中，但是这将丢失数据操作的弹性。除此之外，在数据传输到其他平台（例如通过邮箱发送）的过程中，对数据的控制将会失效。
 技术问题
有鉴于此，本方案实施例提供了敏感数据访问方法、装置及设备，以解决现有技术中敏感数据分享时，容易造成数据不一致，或者丢失数据操作弹性，或者对数据失去控制权，无法管理数据获取的权限的问题。
 技术解决方案
本方案实施例的第一方面提供了一种数据文件，所述数据文件包括源文件和元数据，其中：
在所述源文件中包括有一个或者多个敏感数据；
所述元数据包括用于记录所述源文件中的敏感数据的存储位置的元数据表，以及根据
所述元数据表与敏感数据的存储位置的对应关系，结合用户对所述敏感数据的访问权限生成的访问策略。
结合第一方面，在第一方面的第一种可能实现方式中，所述元数据表中包括一个或者多个元组，所述元组记录有敏感数据的偏移量、敏感数据的长度，所述访问策略根据用户的权限选择所述元数据中的一个或者多个元组。
结合第一方面，在第一方面的第二种可能实现方式中，所述数据文件通过加密的方式存储在文件服务器，通过文件服务器中的访问表记录用户访问数据文件的访问记录。
本方案实施例的第二方面提供了一种数据文件的访问方法，所述数据文件的访问方法包括：
接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
根据所述访问策略，控制所述用户对所述数据文件的访问。
结合第二方面，在第二方面的第一种可能实现方式中，所述根据所述访问策略，控制所述用户对所述数据文件的访问的步骤包括：
当所述访问策略允许用户访问所述数据文件中的敏感数据时，则开始读取所述数据文件中的敏感数据；
当所述访问策略不允许用户所述数据文件中的敏感数据时，则跳过该敏感数据的访问。
结合第二方面，在第二方面的第二种可能实现方式中，所述方法还包括：
当在所述数据文件中写入数据时，将写入数据后的数据文件与写入数据前的数据文件比较，获取新写入的数据信息；
将新写入的数据信息记录在所述数据文件对应的元数据中。
结合第二方面，在第二方面的第三种可能实现方式中，所述数据文件存储在中心文件服务器，所述数据文件的访问方法还包括：
接收到终端的发送的加密的访问请求，记录所述访问请求的用户，以及所访问的文件信息；
根据所述访问请求查找对应的数据文件，将所述数据文件发送给终端。
本方案实施例的第三方面提供了一种数据文件的访问装置，所述数据文件的访问装置包括：
元数据获取单元，用于接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
访问策略查找单元，用于根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
访问控制单元，用于根据所述访问策略，控制所述用户对所述数据文件的访问。
 有益效果
本方案实施例的第四方面提供了一种数据文件的访问设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如第二方面任一项所述数据文件的访问方法的步骤。
本方案实施例的第四方面提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如第二方面任一项所述数据文件的访问方法的步骤。
 附图说明
为了更清楚地说明本方案实施例中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本方案的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本方案实施例提供的数据文件的结构示意图；
图2是本方案实施例提供的数据文件的表现形式的示意图；
图3是本方案实施例提供的数据文件的访问方法的实现流程示意图；
图4是本方案实施例提供的数据文件的访问装置的示意图；
图5为本方案实施例提供的数据加密机制结构示意图；
图6是本方案实施例提供的数据文件的访问设备的示意图。
 本发明的实施方式
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、技术之类的具体细节，以便透彻理解本方案实施例。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施例中也可以实现本方案。在其它情况中，省略对众所周知的系统、装置、电路以及方法的详细说明，以免不必要的细节妨碍本方案的描述。
为了说明本方案所述的技术方案，下面通过具体实施例来进行说明。
如图1所示为本申请实施例所述数据文件的结构示意图，所述数据文件包括源文件，所述源文件可以为不同格式的文件。比如，所述源文件可以WORD文件、POWERPOINT文件、TXT文件等等。在所述源文件中可以包括一个或者多个敏感数据。所述敏感数据可以为所述数据文件中的用户隐私数据，所述敏感数据可以根据敏感数据的特征关键词，或者数据的类型，由系统自动的查找确定，也可以由用户指定。
在数据文件中，还包括与源文件绑定的元数据，所述元数据用于记录所述源文件中的敏感数据的存储位置，如图1所示，所述元数据中包括元数据表，所述元数据表中可以记录有所述敏感数据的存储位置。比如，所述敏感数据的存储位置可以通过敏感数据的偏移量和敏感数据的长度来表示。通过所述敏感数据的偏移量，可以确定敏感数据的起始位置的存储地址，根据所述敏感数据的偏移量和所述敏感数据的长度，可以确定所述敏感数据的结束位置的存储地址。根据所述起始位置的存储地址和结束位置的存储地址，即可确定所述敏感数据的存储地址。
每个数据文件可以和一个或多个元数据关联，元数据通过元数据表记录敏感数据的字节位置，从而可以达到在字节级别上对敏感数据进行保护。所述元数据表可以包括多个元组，每个元组可以标记一个敏感数据的存储地址，所述元组的个数可以与所述敏感数据的个数对应。如图1所示，所述元组可以包括ID号和标记的存储地址。在生成访问策略时，可以通过所述ID号的选择，确定所选择的敏感数据。如图1所示，用户1对应于所选择元数据表中的元组1（ID1）和元组3（ID3）所生成的访问策略，用户2对应于所选择元数据表中的元组1（ID2）和元组3（ID3）所生成的访问策略。
由多个用户的访问策略可以生成访问策略组，不同的访问策略组可以通过不同的元数据关联同一个源文件，在组中用户访问数据时，通过相应的元数据表进行权限的管理。因此在数据分享的过程中，不需要生成文件的副本，更不需要对源文件进行修改，保证了分享过程的可控制性和数据的一致性。字节级别下的细粒度标记使得权限访问更加灵活，实现对不同用户的动态管理，对嵌入在文件中的复杂敏感数据的保护也更加全面。
通过元数据记录数据文件中的零星的敏感数据的偏移量、敏感数据的长度以及敏感数据的访问权限，使得应用程序读取文件时，会产生相应的转化操作。当应用程序读取文件时，系统会把读取数据文件中的源文件所绑定的元数据，根据元数据中的访问策略，查询用户是否具备对敏感数据的访问权限。其中，所述权限可以为系统账户的权限，或者应用程序的权限，或者应用程序的账号所对应的权限等。所述权限还可以在访问策略中约定接收到所述数据文件的任意用户所具有的通用的访问权限。
当通过访问策略检测到用户具有对敏感数据的访问权限时，可以授权用户具有访问权限。当通过访问策略检测到用户不具有对敏感数据的访问权限时，则跳过该敏感数据，对该敏感数据之后的其它非敏感数据进行访问，或者访问其它具有访问权限的敏感数据。
当应用程序对数据文件写入数据时，可以将写入数据文件中的数据中的记录标记在元数据中。具体可以通过将写入数据后的数据文件与写入数据前的数据文件（上一版本的数据文件）进行比较，记录写入数据的位置，或者还可以包括记录写入数据的长度，或者还可以包括写入数据的敏感数据的存储位置等。通过元数据记录写入数据的记录，可以使得数据分享过程中保持数据的一致性，省去对敏感信息检索和模糊化的资源消耗，对系统性能有一定的提升。
另外，所述数据文件的敏感数据在系统中的表现形式分为应用层、文件系统层和硬件层的表现形式，如图2所示，各层分别描述如下：
在应用层，所述敏感数据会通过图形化方式高亮显示，即在图形化的界面中，高亮显示所述敏感数据，方便用户或者管理人员了解数据的结构。
在文件系统层，表现的是源文件和元数据的虚拟地址，在这一层数据文件和元数据形成关联，转化为文件缓冲地址，所述数据文件的源文件和元数据存储在一块连续的虚拟地址，共同读出写入。
在硬件层，源文件和元数据都将作为字节数据在磁盘存储，不存在逻辑意义上的关联。
如图3所示为本申请实施例提供的一种数据文件的访问方法的实现流程示意图，详述如下：
在步骤S301中，接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
具体的，所述元数据为图1所述的元数据基本相同，所述元数据包括标记敏感数据的存储地址的元数据表，以及用于确定用户是否具有对元数据表所标记的敏感数据的访问权限的访问策略。
可以根据需要为不同的用户动态的分配访问策略，通过访问策略控制用户对数据文件的访问。当发送数据文件或者分享数据文件时，只需要动态的调整数据文件中的元数据，不需要生成文件的副本，也不需要对源文件进行修改，即可实现对不同用户的动态管理，并且对嵌入在文件中的复杂敏感数据的保护也更加全面。
在步骤S302中，根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
所述访问策略与用户对应，根据用户的不同，从而可以动态的生成不同的访问策略，实现对数据文件的访问权限的灵活控制。在某一用户的访问策略中，可以记录敏感数据的ID和权限信息，并且在元数据表中相应的记录有敏感数据的ID以及敏感数据的存储地址的对应关系。比如，所述敏感数据的存储地址可以包括敏感数据的偏移地址和敏感数据的长度等。
在所述元数据表中记录有敏感数据的ID，因此，可以根据所述访问策略中的ID，在所述元数据表中查找到敏感数据的存储地址，从而可以确定对该存储地址所存储的敏感数据是否具有访问权限。
在步骤S303中，根据所述访问策略，控制所述用户对所述数据文件的访问。
根据所述访问策略，对所述数据文件进行访问时，如果检测用户具有对敏感数据的访问权限，则可以得到对所述敏感数据访问的授权，如果检测用户不具有对所述敏感数据的访问权限，则跳过该敏感数据。
另外，在对所述数据文件进行访问时，还可以通过应用程序对所述数据文件写入数据。在写入数据时，可以通过和上一版本的数据文件进行比较，通过所述元数据记录写入数据的位置。因此，通过元数据的记录，可以保证数据文件的分享过程中保持数据的致性。
作为本申请优选的一种实施方式，所述数据文件中的源文件还可以块的形式存储和传送。如图4所示为所述数据文件存储在中心文件服务器时，与终端的文件系统交互的示意图，在图中，所述中心文件服务器与终端的文件系统之间的数据文件的输入和输出，均通过加密的方式实现，从而可以保护用户的访问操作的隐私。
如图4所示，在所述中心文件服务器中可以存储两张表格，包括访问表和块表，其中，所述访问表中记录有访问数据文件的用户ID、访问的数据文件的ID以及所述数据文件中的数据块ID，在所述块表中记录有数据文件ID、数据文件中的数据块ID和具体的源文件。通过所述访问表可以记录用户的访问操作，通过所述块表，可以快速的查找用户所需要访问的源文件的位置。
所述中心文件服务器与终端的文件系统以块为单位进行输入和输出的操作，有利于提高读写性能，减少磁盘碎片。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本方案实施例的实施过程构成任何限定。
图5为本申请实施例提供的一种数据文件访问装置的结构示意图，所述数据文件访问装置包括：
元数据获取单元501，用于接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
访问策略查找单元502，用于根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
访问控制单元503，用于根据所述访问策略，控制所述用户对所述数据文件的访问。
优选的，所述访问控制单元包括：
读取子单元，用于当所述访问策略允许用户访问所述数据文件中的敏感数据时，则开始读取所述数据文件中的敏感数据；
跳过子单元，用于当所述访问策略不允许用户所述数据文件中的敏感数据时，则跳过该敏感数据的访问。
优选的，所述装置还包括：
写入数据信息获取单元，用于当在所述数据文件中写入数据时，将写入数据后的数据文件与写入数据前的数据文件比较，获取新写入的数据信息；
记录单元，用于将新写入的数据信息记录在所述数据文件对应的元数据中。
优选的，所述数据文件存储在中心文件服务器，所述数据文件的访问装置还包括：
请求接收单元，用于接收到终端的发送的加密的访问请求，记录所述访问请求的用户，以及所访问的文件信息；
数据文件发送单元，用于根据所述访问请求查找对应的数据文件，将所述数据文件发送给终端。
图5所述数据文件的访问装置，与图3所述的数据文件的访问方法对应。
图6是本方案一实施例提供的数据文件的访问设备的示意图。如图6所示，该实施例的数据文件的访问设备6包括：处理器60、存储器61以及存储在所述存储器61中并可在所述处理器60上运行的计算机程序62，例如数据文件的访问程序。所述处理器60执行所述计算机程序62时实现上述各个数据文件的访问方法实施例中的步骤，例如图3所示的步骤301至303。或者，所述处理器60执行所述计算机程序62时实现上述各装置实施例中各模块/单元的功能，例如图5所示模块501至503的功能。
示例性的，所述计算机程序62可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器61中，并由所述处理器60执行，以完成本方案。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序62在所述数据文件的访问设备6中的执行过程。例如，所述计算机程序62可以被分割成元数据获取单元、访问策略查找单元和访问控制单元，各单元具体功能如下：
元数据获取单元，用于接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
访问策略查找单元，用于根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
访问控制单元，用于根据所述访问策略，控制所述用户对所述数据文件的访问。
所述数据文件的访问设备6可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。所述数据文件的访问设备可包括，但不仅限于，处理器60、存储器61。本领域技术人员可以理解，图6仅仅是数据文件的访问设备6的示例，并不构成对数据文件的访问设备6的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述数据文件的访问设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器60可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器 (Digital Signal Processor，DSP)、专用集成电路 (Application Specific Integrated Circuit，ASIC)、现成可编程门阵列 (Field-Programmable Gate Array，FPGA) 或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述存储器61可以是所述数据文件的访问设备6的内部存储单元，例如数据文件的访问设备6的硬盘或内存。所述存储器61也可以是所述数据文件的访问设备6的外部存储设备，例如所述数据文件的访问设备6上配备的插接式硬盘，智能存储卡（Smart Media Card, SMC），安全数字（Secure Digital, SD）卡，闪存卡（Flash Card）等。进一步地，所述存储器61还可以既包括所述数据文件的访问设备6的内部存储单元也包括外部存储设备。所述存储器61用于存储所述计算机程序以及所述数据文件的访问设备所需的其他程序和数据。所述存储器61还可以用于暂时地存储已经输出或者将要输出的数据。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本方案的范围。
在本方案所提供的实施例中，应该理解到，所揭露的装置/终端设备和方法，可以通过其它的方式实现。例如，以上所描述的装置/终端设备实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口，装置或单元的间接耦合或通讯连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本方案各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本方案实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括是电载波信号和电信信号。
以上所述实施例仅用以说明本方案的技术方案，而非对其限制；尽管参照前述实施例对本方案进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本方案各实施例技术方案的精神和范围，均应包含在本方案的保护范围之内。

Claims (10)

  1. 一种数据文件，其特征在于，所述数据文件包括源文件和元数据，其中：
    在所述源文件中包括有一个或者多个敏感数据；
    所述元数据包括用于记录所述源文件中的敏感数据的存储位置的元数据表，以及根据所述元数据表与敏感数据的存储位置的对应关系，结合用户对所述敏感数据的访问权限生成的访问策略。
  2. 根据权利要求1所述的数据文件，其特征在于，所述元数据表中包括一个或者多个元组，所述元组记录有敏感数据的偏移量、敏感数据的长度，所述访问策略根据用户的权限选择所述元数据中的一个或者多个元组。
  3. 根据权利要求1所述的数据文件，其特征在于，所述数据文件通过加密的方式存储在文件服务器，通过文件服务器中的访问表记录用户访问数据文件的访问记录。
  4. 一种数据文件的访问方法，其特征在于，所述数据文件的访问方法包括：
    接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
    根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
    根据所述访问策略，控制所述用户对所述数据文件的访问。
  5. 根据权利要求4所述的数据文件的访问方法，其特征在于，所述根据所述访问策略，控制所述用户对所述数据文件的访问的步骤包括：
    当所述访问策略允许用户访问所述数据文件中的敏感数据时，则开始读取所述数据文件中的敏感数据；
    当所述访问策略不允许用户所述数据文件中的敏感数据时，则跳过该敏感数据的访问。
  6. 根据权利要求4所述的数据文件的访问方法，其特征在于，所述方法还包括：
    当在所述数据文件中写入数据时，将写入数据后的数据文件与写入数据前的数据文件比较，获取新写入的数据信息；
    将新写入的数据信息记录在所述数据文件对应的元数据中。
  7. 根据权利要求4所述的数据文件的访问方法，其特征在于，所述数据文件存储在中心文件服务器，所述数据文件的访问方法还包括：
    接收到终端的发送的加密的访问请求，记录所述访问请求的用户，以及所访问的文件信息；
    根据所述访问请求查找对应的数据文件，将所述数据文件发送给终端。
  8. 一种数据文件的访问装置，其特征在于，所述数据文件的访问装置包括：
    元数据获取单元，用于接收文件数据的读取指令，获取所述文件数据对应的元数据，所述元数据用于标记所述数据文件中的敏感数据的存储位置以及访问策略；
    访问策略查找单元，用于根据所获取的元数据，查找用户所对应的访问策略，所述访问策略根据用户对所述敏感数据的访问权限生成；
    访问控制单元，用于根据所述访问策略，控制所述用户对所述数据文件的访问。
  9. 一种数据文件的访问设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求4至7任一项所述数据文件的访问方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求4至7任一项所述数据文件的访问方法的步骤。
PCT/CN2017/117511 2017-12-20 2017-12-20 一种数据文件及其访问方法、装置及设备 WO2019119304A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/117511 WO2019119304A1 (zh) 2017-12-20 2017-12-20 一种数据文件及其访问方法、装置及设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/117511 WO2019119304A1 (zh) 2017-12-20 2017-12-20 一种数据文件及其访问方法、装置及设备

Publications (1)

Publication Number Publication Date
WO2019119304A1 true WO2019119304A1 (zh) 2019-06-27

Family

ID=66992860

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/117511 WO2019119304A1 (zh) 2017-12-20 2017-12-20 一种数据文件及其访问方法、装置及设备

Country Status (1)

Country Link
WO (1) WO2019119304A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102724221A (zh) * 2011-03-30 2012-10-10 上海微河信息科技有限公司 云计算企业信息系统及该系统的用户权限设定方法
CN102841902A (zh) * 2011-06-23 2012-12-26 捷达世软件（深圳）有限公司 数据库资料管理方法及系统
CN104463013A (zh) * 2014-12-08 2015-03-25 上海斐讯数据通信技术有限公司 移动终端及其数据加密方法
WO2016138067A1 (en) * 2015-02-24 2016-09-01 Cloudlock, Inc. System and method for securing an enterprise computing environment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102724221A (zh) * 2011-03-30 2012-10-10 上海微河信息科技有限公司 云计算企业信息系统及该系统的用户权限设定方法
CN102841902A (zh) * 2011-06-23 2012-12-26 捷达世软件（深圳）有限公司 数据库资料管理方法及系统
CN104463013A (zh) * 2014-12-08 2015-03-25 上海斐讯数据通信技术有限公司 移动终端及其数据加密方法
WO2016138067A1 (en) * 2015-02-24 2016-09-01 Cloudlock, Inc. System and method for securing an enterprise computing environment

Similar Documents

Publication Publication Date Title
CN108108633B (zh) 一种数据文件及其访问方法、装置及设备
US10140370B1 (en) Systems and methods for maintaining encrypted search indexes on third-party storage systems
US11809584B2 (en) File system metadata protection
US9836616B2 (en) Creating distinct user spaces through user identifiers
EP1946238B1 (en) Operating system independent data management
KR101352515B1 (ko) 권리객체 매핑 테이블 설치 장치 및 방법
US10204235B2 (en) Content item encryption on mobile devices
US20140019498A1 (en) System, method and computer readable medium for file management
US20140019497A1 (en) Modification of files within a cloud computing environment
US9699193B2 (en) Enterprise-specific functionality watermarking and management
CN102945355A (zh) 基于扇区映射的快速数据加密策略遵从
US9749132B1 (en) System and method for secure deletion of data
CN102855452A (zh) 基于加密组块的快速数据加密策略遵从
US8863304B1 (en) Method and apparatus for remediating backup data to control access to sensitive data
CN113918999B (zh) 安全摆渡通道的建立方法、装置、网盘及存储介质
US9665723B2 (en) Watermarking detection and management
TWI377483B (zh)
JP2009064055A (ja) 計算機システム及びセキュリティ管理方法
KR101539811B1 (ko) 암호화 파일 시스템에서 입력/출력의 제어 및 효율성을 향상시키기 위한 방법 및 시스템
US9195811B2 (en) Functionality watermarking and management
US9141808B1 (en) Data loss prevention
WO2019119304A1 (zh) 一种数据文件及其访问方法、装置及设备
US20110010559A1 (en) Method for encrypting digital file, method for decrypting digital file, apparatus for processing digital file and apparatus for converting encryption format
AU2008344947B2 (en) System and method for securely storing information
US10324624B2 (en) Decommissioning of source storages

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17935588

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 10/11/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17935588

Country of ref document: EP

Kind code of ref document: A1