WO2022012669A1 - 数据访问方法、装置、存储介质及电子装置 - Google Patents

数据访问方法、装置、存储介质及电子装置 Download PDF

Info

Publication number
WO2022012669A1
WO2022012669A1 PCT/CN2021/106762 CN2021106762W WO2022012669A1 WO 2022012669 A1 WO2022012669 A1 WO 2022012669A1 CN 2021106762 W CN2021106762 W CN 2021106762W WO 2022012669 A1 WO2022012669 A1 WO 2022012669A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
data
request
action
field
Prior art date
Application number
PCT/CN2021/106762
Other languages
English (en)
French (fr)
Inventor
牛家浩
张强
王德政
屠要峰
刘少麟
陈勇华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP21842693.0A priority Critical patent/EP4184362A4/en
Priority to US18/016,557 priority patent/US20230289464A1/en
Priority to JP2023502749A priority patent/JP2023534263A/ja
Publication of WO2022012669A1 publication Critical patent/WO2022012669A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2453—Query optimisation
    • G06F16/24534—Query rewriting; Transformation
    • G06F16/24547—Optimisations to support specific applications; Extensibility of optimisers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28—Databases characterised by their database models, e.g. relational or object models
    • G06F16/283—Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries

Definitions

  • Embodiments of the present disclosure relate to the field of communications, and in particular, to a data access method, device, storage medium, and electronic device.
  • Transparent encryption implements data encryption at the database layer, Stop would-be attackers from bypassing the database to read sensitive information directly from storage.
  • Applications and users authenticated with database permissions can continue to transparently access encrypted data, while operating system users attempting to read sensitive data in tablespace files and criminals trying to read disk or backup information will not be allowed access to plaintext data.
  • privileged accounts can access any application data in the database. Because privileged accounts and roles have unrestricted access to databases, they are also a prime target for hackers and can be abused by insiders to gain access to confidential information.
  • Transparent encryption and permissions are often ineffective for privileged users. Therefore, the related art only uses permissions as the premise and main means of protecting sensitive fields, and the granularity of protection is relatively coarse, and there are potential security risks.
  • the related art has the problem that the granularity of data protection is relatively coarse and there is a potential security risk.
  • Embodiments of the present disclosure provide a data access method, device, storage medium, and electronic device, so as to at least solve the problem of relatively coarse data protection granularity and potential security risks in the related art.
  • a data access method including: receiving a first access request for requesting access to data in a database; parsing the first access request, The following data corresponding to an access request: a first access parameter, a first request type, and a first controlled field list; based on the first access parameter and the first request type, the first controlled field list is executed A first data protection operation is performed to obtain a target result; a second access request is synthesized based on the target result, and data in the database is accessed based on the second access request to obtain an access result.
  • a data access device comprising: a receiving module configured to receive a first access request for requesting access to data in a database; an obtaining module configured to access the data in the database parsing the request to obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list; an execution module, set to be based on the first access parameter and the The first request type performs a first data protection operation on the first controlled field list, and obtains a target result; the access module is configured to synthesize a second access request based on the target result, and perform a second access request based on the second access request.
  • the data in the database is accessed to obtain the access results.
  • a computer-readable storage medium where a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute any one of the above methods when running steps in the examples.
  • an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor is configured to run the computer program to execute any of the above Steps in Method Examples.
  • FIG. 1 is a block diagram of a hardware structure of a mobile terminal of a data access method according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a data access method according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a data access method according to a specific embodiment of the present disclosure.
  • FIG. 4 is a workflow diagram of managing field-level security policies according to a specific embodiment of the present disclosure.
  • FIG. 5 is a flowchart of a field-level security policy according to a specific embodiment of the present disclosure
  • FIG. 6 is a structural diagram of a data protection device according to a specific embodiment of the present disclosure.
  • FIG. 7 is a flowchart of a data access method according to a specific embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of an implementation scenario of a data access method according to a specific embodiment of the present disclosure.
  • FIG. 9 is a structural block diagram of a data access apparatus according to an embodiment of the present disclosure.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal according to a data access method according to an embodiment of the present disclosure.
  • the mobile terminal may include one or more (only one is shown in FIG. 1 ) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 configured to store data, wherein the above-mentioned mobile terminal may further include a transmission device 106 and an input/output device 108 configured as a communication function.
  • processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA
  • a memory 104 configured to store data
  • the above-mentioned mobile terminal may further include a transmission device 106 and an input/output device 108 configured as a communication function.
  • FIG. 1 is only a schematic diagram, which does not limit the structure of the above-mentioned mobile terminal.
  • the mobile terminal may also include more or fewer components than those shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .
  • the memory 104 may be configured to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the data access methods in the embodiments of the present disclosure.
  • the processor 102 executes the computer programs stored in the memory 104 by running the computer programs.
  • Various functional applications and data processing implement the above method.
  • Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include memory located remotely from the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission means 106 are arranged to receive or transmit data via a network.
  • the specific example of the above-mentioned network may include a wireless network provided by a communication provider of the mobile terminal.
  • the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, RF for short) module, which is configured to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • FIG. 2 is a flowchart of a data access method according to an embodiment of the present disclosure. As shown in FIG. 2 , the flowchart includes the following steps:
  • Step S202 receiving a first access request for requesting access to data in the database
  • Step S204 parse the first access request, and obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list;
  • Step S206 performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result
  • Step S208 synthesizing a second access request based on the target result, and accessing data in the database based on the second access request to obtain an access result.
  • the first access request may be SQL (Structured Query Language, structured query language).
  • SQL Structured Query Language, structured query language
  • the SQL can be parsed to obtain the access parameters, request type and controlled field list of the client.
  • the data protection operation can be performed for each field in the controlled field list one by one, that is, the first data protection operation is performed, and when all the controlled fields are processed, the first SQL statement is resynthesized to obtain the second access request, the database
  • the engine executes the first SQL statement, and feeds back the feedback result to the client.
  • the client can be various applications, programs, commands or scripts that access the database.
  • the access parameters include but are not limited to: original request, such as requesting SQL, etc.; user identity, such as user name, user group, role, etc.; user access level; access time; network parameters, such as IP address, host name, etc. Wait.
  • the first access request for requesting access to data in the database is parsed to obtain the first access parameter, the first request type and the first controlled field list corresponding to the first access request.
  • An access parameter and a first request type perform a first data protection operation on the first controlled field list to obtain a target result, then synthesize a second access request according to the target result, and use the second access request to access data in the database. Since the field-level data protection operation is performed on the access data, the problems of coarse data protection granularity and potential security risks in the related art can be solved, the effect of efficiently protecting the data is achieved, and the security of the data is improved.
  • parsing the access request and acquiring the first controlled field list corresponding to the first access request includes: in the case where the first access request is a data query language DQL class request In this case, the top-level output field list of the DQL class request is determined as the first controlled field list; in the case that the first access request is a request other than the DQL class request, it is determined that all The target field list operated by the other request is determined, and the target field is determined as the first controlled field list.
  • the top-level output field list can be obtained first, and then the top-level output field list can be used as the controlled field list; for other types of requests, the fields operated by the SQL statement can be parsed first, And add the action field to the list of controlled fields.
  • DQL Select query
  • performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type, and obtaining a target result includes: obtaining a target result from the first controlled field list.
  • the rules correspond to different combinations of trusted conditions, request types and processing actions, and the trusted conditions include the permitted access conditions corresponding to the first access parameter; based on the first processing action corresponding to the first field protection rule, the performing the first data protection operation on the first controlled field list to obtain the target result.
  • the first controlled field may be selected in a preset order from the controlled field list, and a field protection rule corresponding to the first controlled field may be obtained, where the field protection rule may include data security classification and data security level, etc. Determining the field protection rule can determine the data security level corresponding to the controlled field, and the data security level itself can be used as a credible condition included in a set of credible conditions, that is, it can be determined whether the user's security level is greater than or equal to the data security level. In this embodiment, the first controlled field is classified and protected, and the same protection rule and data security level can be set for the same type of field.
  • the data security level of the data security classification of the first controlled field may be acquired as the data level of the first controlled field; or, when acquiring the first controlled field
  • the field protection rule of the data classification of the first controlled field can also be obtained as the protection rule of the first controlled field.
  • performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule, and obtaining the target result includes: based on the obtained The first access parameter executes a set of trusted conditions corresponding to the first field protection rule; wherein, the first access parameter includes at least one of the following: original request statement, user identity, user access level, access time, network parameters; determine a first action type and a first action factor included in the first processing action according to a set of credible condition execution results, where the first action type is used to indicate a specific protection operation, and the first action The factor is used to indicate the specific protection action operator name and the actual parameter to be processed; perform protection processing on the first controlled field based on the first action factor to obtain the target result.
  • a set of credible conditions corresponding to the field protection rule of the first controlled field is executed according to the obtained first access parameter, and a corresponding action type is selected according to the calculation result of the credible condition, and a specific protection action factor is executed.
  • the above-mentioned first processing action represents a protection method performed on sensitive data, and includes an action type and an action factor.
  • the action type can include: deny access, allow access, display original data, desensitization, encryption, decryption, anonymization, audit, alarm, custom action, etc.
  • action factor can represent the specific protection action operator name and actual parameter, wherein the actual parameter mainly includes the content to be processed in the first controlled field.
  • the action type and action factor can be customized and extended to deal with data protection in different scenarios. For the refusal to execute the action, you can directly feedback the result to the client and exit the process.
  • performing protection processing on the first controlled field based on the first action factor to obtain the target result includes: the first processing action type includes a desensitization action, an encryption process
  • the first controlled field is synthesized into a new SQL statement segment based on the first action factor to obtain the target result.
  • a new SQL statement segment can be synthesized according to the action factor in the field protection rule to replace the original corresponding SQL statement segment.
  • the method further includes: configuring a field protection rule based on the received first configuration instruction, wherein the field protection rule includes a combination of a request type, a set of trusted conditions, and a processing action; wherein , the request type includes at least one of the following: data query language DQL class, data manipulation language DML class; the credible condition is used to define the basic judgment unit of credible access, at least including credible access type, credible access parameter name, judgment operator and parameter value; the trusted access type includes at least one of the following: identity trusted condition, level trusted condition, network trusted condition, and time trusted condition; the judgment operator includes greater than, greater than equal to, less than or equal to, less than, equal to, not equal to; the processing action includes an action type and an action factor, the action type is used to indicate a specific protection operation, the action factor is used to indicate the specific protection action operator name and Actual parameters to be processed; the action type includes at least one of the following: deny access, allow access, display original data, desensitize, encrypt, decrypt
  • a record field protection rule may be configured according to the first configuration instruction, wherein the field protection rule includes a combination of a request type, a trusted condition, and a processing action, where the processing action may include an action type and an action factor.
  • Field protection rules can be used for different command types (ie, request types) and different field protection methods. They are composed of command types and logical operation expressions of a set of trusted conditions. The corresponding actions are executed according to the execution results of a set of trusted conditions.
  • the command type includes at least DQL class (Data Query Language), DML class (Data Manipulation Language), etc.; logical operations may include operations such as AND, OR, NOT.
  • the trusted condition when the user access level is included in the first access parameter, the trusted condition includes the level trusted condition corresponding to the user access level, wherein, The level trust condition is used to determine that the user access level satisfies the level trust condition when it is determined that the user access level is greater than or equal to the data security level.
  • the credible condition may define a basic judging unit of credible access.
  • the basic judgment unit may include at least one of the following:
  • Identity credible conditions used to limit user identity, including but not limited to user name, user group, role, etc.;
  • Level trust conditions restrict users from obtaining sensitive data according to user access level, data security level, and data security classification;
  • Network trusted conditions used to restrict access to the network, including but not limited to IP addresses, host names, etc.;
  • Time trusted conditions used to limit access time, including but not limited to access time, etc.
  • the user access level can be used to describe the user identity level, including the user access level name and the user access level value.
  • the data types of the user access level and the data security level are of the same type and need to be kept in the same order.
  • Trusted conditions can include trusted access types, trusted access parameter names, decision operators, and parameter values.
  • the decision operators may include greater than, greater than or equal to, less than or equal to, less than, equal to, not equal to, and the like.
  • the method further includes: configuring a data security classification and a data security level corresponding to each controlled field based on the received second configuration instruction, wherein a plurality of controlled fields under the same data security classification
  • the data security level corresponding to the control field is the same.
  • the data security classification may be classified according to the business type of the sensitive data, and may include a classification name, a default data security level, and a default field protection rule.
  • the data security level may include a data security level name and a data security level value, and the like.
  • the field protection rules can be set by the following steps:
  • Step 1 Define the classification and classification level (including user access level, data security level, data security classification);
  • Step 2 Set the user access level
  • Step 3 Assign data protection classification categories and data security levels to sensitive fields
  • Step 4 Set trusted conditions
  • Step 5 Set field protection rules.
  • the above method may be executed in a data access device.
  • the device includes a data protection module and a policy module to realize the sensitive data protection function of the database engine.
  • the device can be built into the database engine.
  • the data protection module can obtain sensitive data protection policies from the policy module, and perform corresponding data protection actions, such as denying access, full masking, partial masking, encryption, anonymization, auditing, and alarming.
  • the policy module includes a classification level unit, a policy management unit, and a policy storage unit, and provides policy support for the data protection module.
  • the classification and classification unit is used for classification and classification management of users and data, including user access level, data security level, data security category, and the like.
  • the policy management unit is responsible for managing data protection policies and providing policy access interfaces.
  • the policy storage unit is responsible for storing data protection policies.
  • FIG. 3 is a flowchart of a data access method according to a specific embodiment of the present disclosure. As shown in FIG. 3 , the process includes:
  • Step S302 receiving a client access request
  • Step S304 obtaining client access parameters
  • Step S306 parse the access request SQL and obtain the request type and the controlled field list
  • Step S308 performing a data protection operation on each field in the controlled field list one by one;
  • Step S310 after all the controlled fields are processed, re-synthesize the first SQL statement
  • Step S312 the database engine executes the first SQL statement, and feeds back the result to the client.
  • the client can be various applications, programs, commands or scripts that access the database; its access parameters can include:
  • 1Original request including but not limited to requesting SQL
  • 2User identity including but not limited to user name, user group, role, etc.
  • 5Network parameters including but not limited to IP address, host name, etc.
  • step S306 may include:
  • DQL Select query
  • first obtain the top-level output field list and then use the top-level output field list as the controlled field list; for other types of requests, first parse out the fields operated by the SQL statement, and add the operation fields to the controlled field. Field list.
  • step S308 the data protection operation includes:
  • Step 1 Select the first controlled field in a preset order from the controlled field list
  • Step 2 obtaining the data security classification, data security level and field protection rules corresponding to the first controlled field
  • the same field protection rules and data security levels can be set for the same type of sensitive fields; if the data security level of the acquired first controlled field is empty, the first controlled field The data security level of the data security classification of the controlled field is used as the data level of the first controlled field; if the field protection rule obtained for the first controlled field is empty, the data of the first controlled field data classification is obtained. The field protection rule is used as the field protection rule of the first controlled field.
  • Step 3 Execute a set of credible conditions corresponding to the field protection rule of the first controlled field, select a corresponding action type according to the credible condition calculation result, and execute a specific protection action factor. For example, for refusing to execute an action, directly feedback the result to the client and exit the process. For desensitization actions, encryption processing actions, decryption processing actions, anonymization actions, etc., a new SQL statement segment is synthesized according to the action factor in the field protection rule to replace its original corresponding SQL statement segment.
  • FIG. 4 is a work flow chart of managing field-level security policies according to a specific embodiment of the present disclosure. As shown in FIG. 4 , the process includes: field protection rules, data security classification, data security level, client access parameters, and the like.
  • the field protection rules are used to define different field protection methods for different command types, and may include a command type and a logical operation expression of a set of trusted conditions, and perform corresponding processing actions according to the execution results of a set of trusted conditions.
  • Command types include at least DQL classes (Data Query Language), DML classes (Data Manipulation Language) and the like.
  • Logical operations include unlimited AND, OR, and NOT operations.
  • the credible condition can define the basic judging unit of credible access, including at least one of them:
  • Identity credible conditions used to limit user identity, including but not limited to user name, user group, role, etc.;
  • Level trust conditions restrict users from obtaining sensitive data according to user access level, data security level, and data security classification;
  • Network trusted conditions used to restrict access to the network, including but not limited to IP addresses, host names, etc.;
  • Time trusted conditions used to limit access time, including but not limited to access time, etc.
  • the trusted conditions include at least the trusted access type, the trusted access parameter name, the decision operator and the parameter value.
  • the decision operators include greater than, greater than or equal to, less than or equal to, less than, equal to, not equal to, and the like.
  • the processing action represents the protection method performed on the sensitive data, including the action type and the action factor.
  • Action types include at least one of them: deny access, allow access, display raw data, desensitize, encrypt, decrypt, anonymize, audit, alert, custom actions, etc.
  • the action factor represents the operator name and actual parameters of the specific protection action to be executed. It should be noted that dynamic types and action factors can be customized and extended to deal with data protection in different scenarios.
  • Data security classification can be classified according to the business type of sensitive data, including at least the classification name, default data security level, and default field protection rules.
  • Data security level including at least the data security level name and data security level value.
  • the parameters that can be included in the client access parameter are basically similar to the above-mentioned client access parameters, and are not repeated here.
  • the user access level is used to describe the user identity level, including at least the user access level name and the user access level value. It should be noted that the data types of the user access level and the data security level are the same type and need to be kept in the same order.
  • field-level access control and attack defense functions can be provided flexibly and effectively according to policies, support multiple command types, support authorized access to obtain sensitive data based on a combination of multiple trusted factors, and implement user name, IP address, access time based Sensitive data access authorization or data dynamic acquisition of other elements, according to the data confidentiality level and user identity level, users can be restricted to only obtain the fully decrypted original data, partially desensitized data, and labels that they are allowed to access. Data, anonymized data, etc., realize different display when different users access the same sensitive data, thus effectively blocking illegal access.
  • FIG. 5 is a flow chart of a field-level security policy according to a specific embodiment of the present disclosure. As shown in FIG. 5 , the flow includes:
  • Step S502 define the classification and grading level.
  • Step S502-1 define the user access level.
  • Users can be graded according to their permission levels, or according to user group types (such as low-authority user groups, partially authorized user groups, or high-authority user groups), and can also be graded according to the geographic location of users (such as China , Europe or North America), etc. As shown in Table 1, Table 1 is a schematic table of user classification access levels.
  • Step S502-2 define the data security level.
  • Sensitive fields can be classified according to data confidentiality (such as public, secret, confidential, or top secret), or according to data attribution departments (core department data, non-core department data), etc. As shown in Table 2, Table 2 is a schematic table of data security levels.
  • Step S502-3, define data security classification.
  • Data protection classification is used to classify sensitive data, and classify and identify data of the same type with similar functions and meanings.
  • ID number is a type of sensitive data, in which the ID number data fields in all databases are managed, and a unified default data level and default field protection rules can be implemented.
  • Table 3 is a schematic table of data security levels.
  • Step S504 setting the user access level.
  • Table 4 is a schematic table for assigning access levels to users.
  • Step S506 assigning a data protection classification category and a data security level to the sensitive field.
  • Table 5 is a schematic table for assigning data protection classification categories and data security levels to sensitive fields.
  • Step S508 setting credible conditions.
  • Table 6 is a schematic table of credible conditions.
  • Step S510 setting field protection rules.
  • Field protection rules define different field protection methods for different command types, which can include command types and logical operation expressions of a set of trusted conditions, and execute corresponding actions according to the execution results of a set of trusted conditions.
  • Table 7 is a schematic table of field protection rules.
  • Table 8 is a schematic table of processing actions.
  • Action ID Action type action factor Action1 access denied Action2 desensitization partialMask(XXX,1,'*',100) Action3 Anonymization K-Anonymity(f,3)
  • the above method can flexibly and effectively provide a protection strategy, flexibly control the database access mode and access content in the database according to the strategy, and effectively block illegal access.
  • FIG. 6 is a structural diagram of a data protection device according to a specific embodiment of the present disclosure. All the aforementioned methods can be executed on the network architecture shown in FIG. 6 . As shown in FIG. 6 , the device includes:
  • the database client 62 may be an application, program, command or script that accesses database services, initiates an access request to the database engine through the network and receives processing results.
  • the client uses the existing technology and does not need to make any changes.
  • the database engine 64 is responsible for completing the business logic processing of client requests.
  • a data protection device can be added to the database engine.
  • the device includes a data protection module and a policy module to realize the sensitive data protection function of the database engine.
  • the data protection device is built in the database engine.
  • the data protection module can obtain sensitive data protection policies from the policy module, and execute corresponding data protection actions, such as denying access, desensitizing, encrypting, decrypting, anonymizing, auditing, and alerting.
  • the policy module includes a classification level unit, a policy management unit, and a policy storage unit, and provides policy support for the data protection module.
  • the classification and classification unit is used for classification and classification management of users and data, including user access level, data security level, data security category, and the like.
  • the policy management unit is responsible for managing data protection policies and providing policy access interfaces.
  • the policy storage unit is responsible for storing data protection policies.
  • the database 66 may be where the data is actually stored, and a database engine may support multiple database instances.
  • the database engine receives the client's access request, the receiving module parses the access request, and the obtained client access parameters, the data protection module parses the access request SQL and obtains the request type and the list of controlled fields. The data protection operation is performed one by one for each field of the database; after all the controlled fields are processed, the first SQL statement is re-synthesized, the database engine executes the first SQL statement, and the result is fed back to the client.
  • FIG. 7 is a flowchart of a data access method according to a specific embodiment of the present disclosure. As shown in FIG. 7 , the process includes:
  • Step S702 Hive (Hive is a data warehouse tool based on hadoop, which can map the structured data file into a database table and provide a SQL-like query function) client directly initiates an SQL access request to the Hive database engine through the network.
  • Hive is a data warehouse tool based on hadoop, which can map the structured data file into a database table and provide a SQL-like query function
  • Step S704 the Hive database engine obtains client access parameters.
  • the access parameters include at least one of:
  • 1Original request including but not limited to requesting SQL
  • 2User identity including but not limited to user name, user group, role, etc.
  • 5Network parameters including but not limited to IP address, host name, etc.
  • Step S706 the SQL parser of the Hive database engine parses the SQL statement in the original request, constructs a syntax tree, abstracts and structures the SQL, and generates a reconstructed abstract syntax tree.
  • Step S708 parse the abstract syntax tree, parse the request SQL statement, obtain the request type of the SQL statement, obtain the top-level output field list as the controlled field list for the DQL class request, and parse out the fields operated by the SQL statement for other types of requests, and Add the action field to the list of controlled fields.
  • step S710 the command type is determined.
  • step S712 is performed, and when the command type is non-DQL type, step S714 is performed.
  • Step S712 generating a top-level output field list as a controlled field list.
  • the obtained list of controlled fields is:
  • emp and dept are database table names, and others are field names;
  • Step S714 acquire the field name and add it to the controlled field list.
  • the obtained list of controlled fields is:
  • Customers is the database table name, and the others are the field names;
  • Step S716 Select a first controlled field in a preset order from the controlled field list, and acquire the data protection classification, data security level, and field protection rule corresponding to the first controlled field.
  • Table 9 is a schematic table of the acquired field protection rules.
  • the data security level of the acquired first controlled field is empty, the data security level of the data classification of the first controlled field is acquired as the data security level of the first controlled field;
  • the field protection rule obtained for the first controlled field is empty, the field protection rule obtained by the data classification of the first controlled field is used as the protection rule of the first controlled field;
  • Step S718 Execute a set of credible conditions corresponding to the field protection rule of the first controlled field, select a corresponding action type according to the credible condition calculation result, and execute a specific protection action factor.
  • Step S720 determine the action type, if the action type is refusal to execute, then execute step S722, if the action type is desensitization processing, encryption processing, decryption processing, anonymization processing, etc., then execute step S724, if the action type is auditing, then execute step S724.
  • Step S726 is executed.
  • Step S722 directly feeding back the result to the client, and exiting the process.
  • Step S724 synthesizing a new SQL statement segment according to the action factor in the field protection rule to replace its original corresponding SQL statement segment.
  • the protection rule of the select statement type is: Selector2->Action1; execute Selector2 judgment, that is, judge whether the user access level value is ⁇ data protection level value, if so, execute Action1 action, that is, refuse to execute, otherwise Go ahead.
  • the protection rules for the select statement type are: Selector1->Action2; execute Selector1 judgment, that is, judge whether the user is Zhang San, if so, execute Action2 action, that is, use partialMask(sal,1,'*',100 ) is executed as a partial desensitization algorithm.
  • the SQL statement partialMask(sal, 1, '*', 100) replaces the original value sal of the abstract syntax tree node corresponding to the controlled field sal.
  • step S728 it is judged whether all fields have been processed. If the judgment result is yes, step S730 is executed, and if the judgment result is no, step S716 is executed.
  • Step S730 traverse the abstract syntax tree, resynthesize the first SQL statement, and determine that the first SQL statement is the final SQL statement to be executed.
  • the rewritten SQL statement automatically partially desensitizes the sensitive field sal.
  • Mask is the protection factor
  • the string is set to *.
  • Step S732 the database executes the rewritten SQL statement.
  • Step S734 the database feeds back the processing result to the client according to the finally executed SQL statement.
  • field-level access control and attack defense functions can be provided flexibly and effectively according to policies, support multiple command types, support authorized access to obtain sensitive data based on a combination of multiple trusted factors, and implement user name, IP address, access time, etc.
  • Sensitive data access authorization of elements or dynamic data acquisition users can be restricted to only obtain fully decrypted original data, partially desensitized data, and label data according to the data confidentiality level and user identity level. , anonymized data, etc., to achieve different display when different users access the same sensitive data, thereby effectively blocking illegal access.
  • private data can be protected efficiently, in real time and transparently, and users can be completely unaware of the data protection process.
  • the Hive database stores a large amount of sensitive data. By setting flexible data protection policies, sensitive data in the Hive database can be transparently protected in real time during client access.
  • 8 is a schematic diagram of an implementation scenario of a data access method according to a specific embodiment of the present disclosure, for performing the following steps:
  • Step 1 log in, specifically, the compliance administrator uses his own account and password to log in to the database system;
  • Step 2 set the protection policy, the compliance administrator sets the field protection policy through command mode or interface configuration mode;
  • Step 3 the user initiates an access request through the client, specifically, directly initiates a query request to the database engine;
  • Step 4 perform data protection, specifically, after the database engine receives the access request from the client, the receiving module parses the access request, and the obtained client access parameters, the data protection module parses the access request SQL and obtains the request type and the received data.
  • Controlled field list perform data protection operations for each field in the controlled field list one by one; after all controlled fields are processed, re-synthesize the first SQL statement, the database engine executes the first SQL statement, and feeds back the results to all controlled fields described client.
  • steps 1-2 are performed by the compliance administrator, step 3 is performed by the user, and step 4 is performed by the data protection device.
  • a data access device is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementations, and what has been described will not be repeated.
  • the term "module” may be a combination of software and/or hardware that implements a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, implementations in hardware, or a combination of software and hardware, are also possible and contemplated.
  • FIG. 9 is a structural block diagram of a data access apparatus according to an embodiment of the present disclosure. As shown in FIG. 9 , the apparatus includes:
  • the receiving module 92 is configured to receive a first access request for requesting access to data in the database
  • the obtaining module 94 is configured to parse the access request, and obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list;
  • An execution module 96 configured to perform a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result
  • the access module 98 is configured to synthesize a second access request based on the target result, and access data in the database based on the second access request to obtain an access result.
  • the data access device corresponds to the database engine shown in FIG. 6
  • the receiving module 92 corresponds to the receiving module shown in FIG. 6
  • the execution module 96 corresponds to the data protection module shown in FIG. 6
  • the The access module 98 corresponds to the above-described execution engine.
  • the obtaining module 94 corresponds to the classification and grading unit in the above-mentioned policy module
  • the access module 98 corresponds to the policy storage unit and the policy management unit in the above-mentioned policy module.
  • the obtaining module 94 may parse the access request and obtain the first controlled field list corresponding to the first access request in the following manner: in the first access request In the case where the request is a data query language DQL request, the top-level output field list of the DQL request is determined as the first controlled field list; when the first access request is other than the DQL request In the case of other requests, determine the target field list operated by the other request, and determine the target field list as the first controlled field list.
  • the execution module 96 may perform the first data protection operation on the first controlled field list based on the first access parameter and the first request type in the following manner, and obtain the target Result: select a controlled field from the first controlled field list in a preset order as the first controlled field; determine the first field protection rule, data security classification, data corresponding to the first controlled field security level, wherein different field protection rules correspond to different combinations of trusted conditions, request types and processing actions, and the trusted conditions include the permitted access conditions corresponding to the first access parameter; based on the first field protection rules The corresponding first processing action in performs the first data protection operation on the first controlled field to obtain the target result.
  • the execution module 96 may implement the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule in the following manner: Obtaining the target result: executing a set of trusted conditions corresponding to the first field protection rule based on the acquired first access parameter; wherein the first access parameter includes at least one of the following: an original request statement, a user identity , user access level, access time, network parameters; determine the first action type and first action factor included in the first processing action according to a set of credible condition execution results, wherein the first action type is used to indicate For specific protection operations, the first action factor is used to indicate the name of the specific protection action operator and the actual parameter to be processed; perform protection processing on the first controlled field based on the first action factor to obtain the describe the target results.
  • the execution module 96 may implement the protection processing on the first controlled field based on the first action factor to obtain the target result by the following manner: in the first processing
  • the action type includes one of a desensitization action, an encryption processing action, a decryption processing action, an anonymization action, and a custom action
  • the first controlled field is synthesized into a new SQL statement segment based on the first action factor, to obtain the target result.
  • the apparatus may be configured to configure a field protection rule based on the received first configuration instruction, wherein the field protection rule includes a combination of a request type, a set of trusted conditions, and a processing action; wherein , the request type includes at least one of the following: data query language DQL class, data manipulation language DML class; the credible condition is used to define the basic judgment unit of credible access, at least including credible access type, credible access parameter name, judgment operator and parameter value; the trusted access type includes at least one of the following: identity trusted condition, level trusted condition, network trusted condition, and time trusted condition; the judgment operator includes greater than, greater than equal to, less than or equal to, less than, equal to, not equal to; the processing action includes an action type and an action factor, the action type is used to indicate a specific protection operation, the action factor is used to indicate the specific protection action operator name and Actual parameters to be processed; the action type includes at least one of the following: deny access, allow access, display original data, desensitize, encrypt, decrypt
  • the trusted condition when the user access level is included in the first access parameter, includes the level trusted condition corresponding to the user access level, wherein, The level trust condition is used to determine that the user access level satisfies the level trust condition when it is determined that the user access level is greater than or equal to the data security level.
  • the apparatus may be further configured to configure the data security classification and data security level corresponding to each controlled field based on the received second configuration instruction, wherein multiple data security classifications under the same data security classification The data security levels corresponding to the controlled fields are the same.
  • the above modules can be implemented by software or hardware, and the latter can be implemented in the following ways, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination The forms are located in different processors.
  • Embodiments of the present disclosure also provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.
  • the above-mentioned computer-readable storage medium may include, but is not limited to, a USB flash drive, a read-only memory (Read-Only Memory, referred to as ROM for short), and a random access memory (Random Access Memory, referred to as RAM for short) , mobile hard disk, magnetic disk or CD-ROM and other media that can store computer programs.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • An embodiment of the present disclosure also provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.
  • the above-mentioned electronic device may further include a transmission device and an input-output device, wherein the transmission device is connected to the above-mentioned processor, and the input-output device is connected to the above-mentioned processor.
  • modules or steps of the present disclosure can be implemented by a general-purpose computing device, and they can be centralized on a single computing device or distributed in a network composed of multiple computing devices
  • they can be implemented in program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, can be performed in a different order than shown here.
  • the described steps, or they are respectively made into individual integrated circuit modules, or a plurality of modules or steps in them are made into a single integrated circuit module to realize.
  • the present disclosure is not limited to any particular combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Automation & Control Theory (AREA)
  • Computational Linguistics (AREA)
  • Medical Informatics (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种数据访问方法、装置、存储介质及电子装置，其中，该方法包括：接收用于请求对数据库中的数据进行访问的第一访问请求（S202）；对所述第一访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表（S204）；基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果（S206）；基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果（S208）。

Description

数据访问方法、装置、存储介质及电子装置
相关申请的交叉引用
本公开基于2020年7月16日提交的发明名称为“数据访问方法、装置、存储介质及电子装置”的中国专利申请CN202010688666.6，并且要求该专利申请的优先权，通过引用将其所公开的内容全部并入本公开。
技术领域
本公开实施例涉及通信领域，具体而言，涉及一种数据访问方法、装置、存储介质及电子装置。
背景技术
随着大数据时代的来临，用户隐私泄露问题日益严重。与此同时，各种大数据技术层出不穷，新的技术架构、支撑平台和大数据软件不断涌现，使得数据安全及隐私保护技术面临更大的挑战。
在相关技术中，为保护某些高度敏感信息(如信用卡、姓名和身份证号码或者对其他被认为是关键的数据)通常采用权限控制及透明加密技术，透明加密通过在数据库层执行数据加密，阻止可能的攻击者绕过数据库直接从存储读取敏感信息。通过数据库权限验证的应用和用户可以继续透明地访问加密数据，而尝试读取表空间文件中的敏感数据的操作系统用户以及尝试读取磁盘或备份信息的不法之徒将不允许访问明文数据。与此同时，特权账户可以访问数据库中的任何应用程序数据。由于特权帐户和角色可以不受限制地访问数据库，因此也成为黑客的主要攻击目标，还可能被内部人员滥用以获取机密信息，通过透明加密及权限往往对特权用户无效。因此，相关技术仅通过权限作为敏感字段保护的前提和主要手段，保护粒度较粗，存在安全隐患。
由此可知，相关技术中存在数据保护粒度较粗，存在安全隐患的问题。
针对相关技术中存在的上述问题，目前尚未提出有效的解决方案。
发明内容
本公开实施例提供了一种数据访问方法、装置、存储介质及电子装置，以至少解决相关技术中存在的数据保护粒度较粗，存在安全隐患的问题。
根据本公开的一个实施例，提供了一种数据访问方法，包括：接收用于请求对数据库中的数据进行访问的第一访问请求；对所述第一访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表；基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
根据本公开的另一个实施例，提供了一种数据访问装置，包括：接收模块，设置为接收用于请求对数据库中的数据进行访问的第一访问请求；获取模块，设置为对所述访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第 一受控字段列表；执行模块，设置为基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；访问模块，设置为基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
根据本公开的又一个实施例，还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本公开的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
附图说明
图1是本公开实施例的一种数据访问方法的移动终端的硬件结构框图；
图2是根据本公开实施例的数据访问方法的流程图；
图3是根据本公开具体实施例的数据访问方法流程图；
图4是根据本公开具体实施例的管理字段级安全策略的工作流程图；
图5是根据本公开具体实施例的字段级安全策略的流程图；
图6是根据本公开具体实施例的数据保护装置结构图；
图7是根据本公开具体实施例的数据访问方法流程图；
图8是根据本公开具体实施例的数据访问方法实行场景示意图；
图9是根据本公开实施例的数据访问装置的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本公开的实施例。
需要说明的是，本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本公开实施例中所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图1是本公开实施例的一种数据访问方法的移动终端的硬件结构框图。如图1所示，移动终端可以包括一个或多个(图1中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和设置为存储数据的存储器104，其中，上述移动终端还可以包括设置为通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述移动终端的结构造成限定。例如，移动终端还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可设置为存储计算机程序，例如，应用软件的软件程序以及模块，如本公开实施例中的数据访问方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端。上述网络的实例包括但不限于互 联网、企业内部网、局域网、移动通信网及其组合。
传输装置106设置为经由一个网络接收或者发送数据。上述的网络具体实例可包括移动终端的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其设置为通过无线方式与互联网进行通讯。
在本实施例中提供了一种数据访问方法，图2是根据本公开实施例的数据访问方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，接收用于请求对数据库中的数据进行访问的第一访问请求；
步骤S204，对所述第一访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表；
步骤S206，基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；
步骤S208，基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
在上述实施例中，第一访问请求可以是SQL(Structured Query Language，结构化查询语言)。在接收客户端的SQL后，可以对SQL进行解析，获取客户端的访问参数、请求类型及受控字段列表。然后可以对受控字段列表中的每一个字段逐个执行数据保护操作,即，执行第一数据保护操作，当所有受控字段处理完毕后，重新合成第一SQL语句，得到第二访问请求,数据库引擎执行第一SQL语句，将反馈结果反馈至所述客户端。其中，客户端可以是访问数据库的各种应用、程序、命令或者脚本等。
在上述实施例中，访问参数包括但不限于：原始请求，如请求SQL等；用户身份，如用户名、用户组、角色等；用户访问级别；访问时间；网络参数，如IP地址、主机名等。
通过本公开，解析用于请求对数据库中的数据进行访问的第一访问请求，以得到与第一访问请求所对应的第一访问参数、第一请求类型以及第一受控字段列表，根据第一访问参数以及第一请求类型对第一受控字段列表执行第一数据保护操作，得到目标结果，再根据目标结果合成第二访问请求，并利用第二访问请求对数据库中的数据进行访问。由于对访问数据进行了字段级的数据保护操作，因此，可以解决相关技术中存在的数据保护粒度较粗，存在安全隐患的问题，达到高效保护数据的效果，提高了数据的安全性。
在一个示例性实施例中，对所述访问请求进行解析，获取与所述第一访问请求所对应的第一受控字段列表包括：在所述第一访问请求为数据查询语言DQL类请求的情况下，将所述DQL类请求的顶层输出字段列表确定为所述第一受控字段列表；在所述第一访问请求为除所述DQL类请求之外的其他请求的情况下，确定所述其他请求所操作的目标字段列表，将所述目标字段确定为所述第一受控字段列表。在本实施例中，对DQL(Select查询)类请求可以首先获取其顶层输出字段列表，然后将顶层输出字段列表作为受控字段列表；对其他类型请求可以先解析出SQL语句所操作的字段，并将操作字段加入到受控字段列表。
比如，对于下述的DQL类请求：
select ename,deptno,sal
from emp
where deptno＝
(select deptno from dept where loc＝'NEW YORK')；
获取的受控字段列表为：
emp.ename、dept.deptno、emp.sal；
再比如，对于下述的DML类update类请求：
UPDATE Customers SET ContactName＝'Alfred Schmidt',
City＝'Frankfurt'
WHERE Customer ID＝1；
获取的受控字段列表为：
Customers.ContactName、Customers.City。
在一个示例性实施例中，基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果包括：从所述第一受控字段列表中按预设顺序选取一个受控字段作为第一受控字段；确定与所述第一受控字段对应的第一字段保护规则、数据安全分类、数据安全级别，其中，不同的字段保护规则对应不同的可信条件、请求类型及处理动作的组合，所述可信条件中包括第一访问参数对应的允许访问条件；基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段列表执行所述第一数据保护操作，得到所述目标结果。在本实施例中，可以从受控字段列表中按预设顺序选取第一受控字段，并获取第一受控字段对应的字段保护规则，其中，字段保护规则可以包括数据安全分类和数据安全级别等。确定字段保护规则可以确定受控字段对应数据安全级别，数据安全级别本身可以作为一组可信条件中包含的一个可信条件，即，可以判断用户的安全级别是否大于等于数据安全级别。在本实施例中，对第一受控字段进行分类保护，同一类字段可设置相同的保护规则及数据安全级别。当获取第一受控字段的数据安全级别为空时，可以获取第一受控字段数据安全分类的数据安全级别作为所述第一受控字段的数据级别；或者，当获取第一受控字段的数据安全级别为空时，还可以获取第一受控字段数据分类的字段保护规则作为第一受控字段的保护规则。
在一个示例性实施例中，基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段执行所述第一数据保护操作，得到所述目标结果包括：基于所获取的第一访问参数执行所述第一字段保护规则对应的一组可信条件；其中，所述第一访问参数至少包括以下之一：原始请求语句、用户身份、用户访问级别、访问时间、网络参数；根据一组可信条件执行结果确定所述第一处理动作所包括的第一动作类型和第一动作因子，其中，所述第一动作类型用于指示具体保护操作，所述第一动作因子用于指示所述具体保护动作算子名及待处理的实际参数；基于所述第一动作因子对所述第一受控字段进行保护处理，以得到所述目标结果。在本实施例中，根据获取的第一访问参数执行第一受控字段的字段保护规则对应的一组可信条件，根据可信条件计算结果，选择对应动作类型，执行具体保护动作因子。其中，上述第一处理动作表示对敏感数据执行的保护方法，包括动作类型、动作因子。其中，动作类型可以包括：拒绝访问、允许访问、显示原始数据、脱敏、加密、解密、匿名化、审计、告警、自定义动作等；动作因子可以代表执行的具体保护动作算子名及实际参数，其中，实际参数主要包括第一受控字段中待被处理的内容。需要说明的是，动作类型及动作因子可以自定义扩展，应对不同场景下的数据保护。对于拒绝执行动作，可以直接向客户端反馈结果， 退出流程。
在一个示例性实施例中，基于所述第一动作因子对所述第一受控字段进行保护处理，以得到所述目标结果包括：在所述第一处理动作类型包括脱敏动作、加密处理动作、解密处理动作、匿名化动作以及自定义动作之一的情况下，基于所述第一动作因子将所述第一受控字段合成新的SQL语句段，以得到所述目标结果。在本实施例中，对于脱敏动作、加密处理动作、解密处理动作、匿名化动作、自定义动作等，可以根据字段保护规则中的动作因子合成新SQL语句段替换其原对应SQL语句段。
在一个示例性实施例中，所述方法还包括：基于接收到的第一配置指令配置字段保护规则，其中，所述字段保护规则包括请求类型、一组可信条件以及处理动作的组合；其中，所述请求类型包括以下至少之一：数据查询语言DQL类、数据操作语言DML类；所述可信条件用于定义可信访问的基本判断单元，至少包括可信访问类型、可信访问参数名、判定操作符及参数值；所述可信访问类型包括以下至少之一：身份可信条件、级别可信条件、网络可信条件、时间可信条件；所述判定操作符包括大于、大于等于、小于等于、小于、等于、不等于；所述处理动作包括动作类型和动作因子，所述动作类型用于指示具体保护操作，所述动作因子用于指示所述具体保护动作算子名及待处理的实际参数；所述动作类型包括以下至少之一：拒绝访问、允许访问、显示原始数据、脱敏处理、加密处理、解密处理、匿名化处理、审计处理、告警处理。在本实施例中，可以根据第一配置指令配置记录字段保护规则，其中，字段保护规则包括请求类型、可信条件以及处理动作的组合，其中，处理动作可以包括动作类型和动作因子。字段保护规则可以针对不同的命令类型(即请求类型)不同的字段保护方法，由命令类型及一组可信条件的逻辑操作表达式组合而成，根据一组可信条件执行结果执行对应的动作。其中，命令类型至少包括DQL类(数据查询语言)、DML类(数据操纵语言)等；逻辑操作可以包括与、或、非等操作。
在一个示例性实施例中，在所述第一访问参数中包括所述用户访问级别的情况下，所述可信条件中包括与所述用户访问级别对应的所述级别可信条件，其中，所述级别可信条件用于在确定所述用户访问级别大于或等于所述数据安全级别时，确定所述用户访问级别满足所述级别可信条件。在本实施例中，可信条件可以定义可信访问的基本判断单元。其中，基本判断单元可以至少包括以下之一：
身份可信条件，用于限制用户身份，包括不限于用户名、用户组、角色等；
级别可信条件，根据用户访问级别、数据安全级别、数据安全分类限制用户获取敏感数据；
网络可信条件，用于限制访问网络，包括不限于I P地址、主机名等；
时间可信条件，用于限制访问时间，包括不限于访问时间等。
其中，用户访问级别可以用于描述用户身份级别,包括用户访问级别名及用户访问级别值。需要说明的是，用户访问级别与数据安全级别的数据类型为同一类型，且需要保持同序。可信条件可以包括可信访问类型、可信访问参数名、判定操作符及参数值。其中，判定操作符可以包括大于、大于等于、小于等于、小于、等于、不等于等。
在一个示例性实施例中，所述方法还包括：基于接收到的第二配置指令配置与各受控字段对应的数据安全分类以及数据安全级别，其中，处于同一数据安全分类下的多个受控字段所对应的数据安全级别相同。在本实施例中，数据安全分类可以根据敏感数据的业务类型进 行分类，可以包括分类名、默认数据安全级别、默认字段保护规则。数据安全级别可以包括数据安全级别名及数据安全级别值等。
在上述实施例中，具体可以通过如下步骤设置字段保护规则：
步骤1：定义分类分级等级(包括用户访问级别、数据安全级别、数据安全分类)；
步骤2：设置用户访问级别；
步骤3：为敏感字段分配数据保护分类类别及数据安全级别；
步骤4：设置可信条件；
步骤5：设置字段保护规则。
在一个可选的实施例中，上述方法可以运行在数据访问装置中。其中，该装置包括数据保护模块、策略模块，用以实现数据库引擎的敏感数据保护功能。该装置可以内置在数据库引擎中。数据保护模块可以从策略模块中获取敏感数据保护策略，执行对应的数据保护动作，例如，拒绝访问、全脱敏处理、部分脱敏处理、加密处理、匿名化处理、审计、告警等。策略模块包括分类级别单元、策略管理单元、策略存储单元，为数据保护模块提供策略支撑。其中，分类分级单元用于对用户及数据进行分类分级管理，包括用户访问级别、数据安全级别、数据安全类别等。策略管理单元，负责对数据保护策略进行管理并提供策略访问接口。策略存储单元，负责存储数据保护策略。
下面结合具体实施方式对访问数据进行说明：
图3是根据本公开具体实施例的数据访问方法流程图，如图3所示，该流程包括：
步骤S302，接收客户端访问请求；
步骤S304，获取客户端访问参数；
步骤S306，解析访问请求SQL并获取请求类型及受控字段列表；
步骤S308，对所述受控字段列表中的每一个字段逐个执行数据保护操作；
步骤S310，所有受控字段处理完毕后，重新合成第一SQL语句；
步骤S312，数据库引擎执行所述第一SQL语句，将结果反馈至所述客户端。
其中，客户端可以是访问数据库的各种应用、程序、命令或者脚本等；其访问参数可以包括：
①原始请求，包括不限于请求SQL；
②用户身份，包括不限于用户名、用户组、角色等；
③用户访问级别；
④访问时间；
⑤网络参数，包括不限于IP地址、主机名等。
其中，步骤S306中获取受控字段列表操作可以包括：
对DQL(Select查询)类请求首先获取其顶层输出字段列表，然后将顶层输出字段列表作为受控字段列表；对其他类型请求先解析出SQL语句所操作的字段，并将操作字段加入到受控字段列表。
其中，步骤S308中，数据保护操作包括：
步骤1、从所述受控字段列表中按预设顺序选取第一受控字段；
步骤2、获取所述第一受控字段对应的数据安全分类、数据安全级别及字段保护规则；
需要说明的是，对敏感字段进行分类保护，同一类敏感字段可设置相同的字段保护规则 及数据安全级别；若获取所述第一受控字段的数据安全级别为空，则获取所述第一受控字段数据安全分类的数据安全级别作为所述第一受控字段的数据级别；若获取所述第一受控字段的字段保护规则为空，则获取所述第一受控字段数据分类的字段保护规则作为所述第一受控字段的字段保护规则。
步骤3、执行所述第一受控字段的字段保护规则对应的一组可信条件，根据可信条件计算结果，选择对应动作类型，执行具体保护动作因子。例如，对于拒绝执行动作，直接向客户端反馈结果，退出流程。对于脱敏动作、加密处理动作、解密处理动作、匿名化动作等，根据字段保护规则中的动作因子合成新SQL语句段替换其原对应SQL语句段。
图4是根据本公开具体实施例的管理字段级安全策略的工作流程图，如图4所示，该流程包括：字段保护规则、数据安全分类、数据安全级别、客户端访问参数等。
其中，字段保护规则用于针对不同的命令类型定义不同的字段保护方法，可以包括命令类型及一组可信条件的逻辑操作表达式，根据一组可信条件执行结果执行对应的处理动作。命令类型至少包括DQL类(数据查询语言)、DML类(数据操纵语言)等。逻辑操作包括不限与、或、非操作。
其中，可信条件可以定义可信访问的基本判断单元，至少包括其中之一：
身份可信条件，用于限制用户身份，包括不限于用户名、用户组、角色等；
级别可信条件，根据用户访问级别、数据安全级别、数据安全分类限制用户获取敏感数据；
网络可信条件，用于限制访问网络，包括不限于IP地址、主机名等；
时间可信条件，用于限制访问时间，包括不限于访问时间等。
可信条件至少包括可信访问类型、可信访问参数名、判定操作符及参数值。其中，判定操作符包括大于、大于等于、小于等于、小于、等于、不等于等。
其中，处理动作表示对敏感数据执行的保护方法，包括动作类型、动作因子。动作类型至少包括其中之一：拒绝访问、允许访问、显示原始数据、脱敏、加密、解密、匿名化、审计、告警、自定义动作等。动作因子代表了执行的具体保护动作算子名及实际参数。需要说明的是，动态类型及动作因子可以自定义扩展，应对不同场景下的数据保护。
数据安全分类可以根据敏感数据的业务类型进行分类，至少包括分类名、默认数据安全级别、默认字段保护规则。
数据安全级别，至少包括数据安全级别名及数据安全级别值。
客户端访问参数可以包括的参数与上述客户端访问参数基本相似，在此不在赘述。其中，用户访问级别用于描述用户身份级别,至少包括用户访问级别名及用户访问级别值，需要说明的是，用户访问级别与数据安全级别的数据类型为同一类型，且需要保持同序。
采用上述步骤，可以根据策略灵活有效提供字段级访问控制和攻击防御功能，支持多种命令类型，支持基于多种可信因素组合授权访问获取敏感数据，实现基于用户名、I P地址、访问时间等要素的敏感数据访问授权或者数据动态获取，可依据数据机密性级别及用户身份级别限制用户只能获取到其所允许访问的有可能是完全解密的原始数据、部分脱敏后的数据、标签数据、匿名化数据等，实现不同用户对同一敏感数据访问时进行不同的展示，从而有效阻断非法访问。
同时，直接利用数据库引擎自身的处理能力，可以高效、实时、透地保护隐私数据，用户可以完全不感知数据保护过程。
图5是根据本公开具体实施例的字段级安全策略的流程图，如图5所示，该流程包括：
步骤S502，定义分类分级等级。
步骤S502-1，定义用户访问级别。
可以按照用户的权限级别对用户进行分级，或者可以按照用户组类型进行分级(如低权用户组、部分授权用户组或高权用户组),还可以按照用户所在的地理位置进行分级(如中国、欧洲或北美地区)等。如表1所示，表1为用户分类访问级别的示意表格。
表1
用户访问级别 值 备注
LOWLEVEL 0 低权用户
MIDDLEVEL 5 部分授权用户
HIGHLEVEL 10 高权用户
步骤S502-2，定义数据安全级别。
可以按照数据机密性进行对敏感字段划分级别(如公开、秘密、机密或绝密)，或者按照数据归属部门进行级别(核心部门数据、非核心部门数据)等。如表2所示的，表2为数据安全级别的示意表格。
表2
数据安全级别 值 备注
PUBLIC 0 内部公开
SECRET 2 秘密
CONFIDENTIAL 5 机密
TOPSECRET 10 绝密
步骤S502-3，定义数据安全分类。
数据保护分类用于对敏感数据进行分类，将同一类功能含义类似的数据进行分类标识。例如“身份证号”作为一类敏感数据，在该类管理所有数据库中的身份证号数据字段，并可实施统一的默认数据级别及默认的字段保护规则。如表3所示的，表3为数据安全级别的示意表格。
表3
数据安全分类 默认数据保护级别 默认字段保护规则 备注
ID SECRET Rule1 身份证号码类
NAME SECRET Rule2 姓名类
ADDRESS SECRET Rule3 地址类
CARD TOPSECRET Rule4 卡类
步骤S504，设置用户访问级别。
如表4所示，表4为用户分配访问级别的示意表格。
表4
用户名 用户访问级别
张三 LOWLEVEL
李四 MIDDLEVEL
王五 HIGHLEVEL
步骤S506，为敏感字段分配数据保护分类类别及数据安全级别。
如表5所示，表5为敏感字段分配数据保护分类类别及数据安全级别的示意表格。
表5
数据库 表 字段 数据安全级别 数据保护分类
DBS1 T1 f1 SECRET ID
DBS1 T1 f2 SECRET NAME
DBS1 T1 f3   ADDRESS
DBS1 T1 f4 TOPSECRET CARD
步骤S508，设置可信条件。
如表6所示，表6为可信条件的示意表格。
表6
Figure PCTCN2021106762-appb-000001
步骤S510，设置字段保护规则。
字段保护规则是针对不同的命令类型定义不同的字段保护方法，可以包括命令类型及一组可信条件的逻辑操作表达式，根据一组可信条件执行结果执行对应的动作。
如表7所示，表7为字段保护规则的示意表格。
表7
数据库 表 字段 命令类型 可信条件 动作
DBS1 T1 f1 select Selector Action1
DBS1 T1 f2 insert Selector2 Action2
DBS1 T1 f3 update (Selector)||(Selector3) Action3
如表8所示，表8处理动作的示意表格。
表8
动作ID 动作类型 动作因子
Action1 拒绝访问  
Action2 脱敏 partialMask(XXX,1，’*’,100)
Action3 匿名化处理 K-Anonymity(f,3)
通过上述方法可以灵活有效提供保护策略，在数据库中灵活根据策略控制数据库的访问方式和访问内容，有效阻断非法访问。
图6是根据本公开具体实施例的数据保护装置结构图，前述方法均可运行于图6所示的网络架构上，如图6所示，该装置包括：
数据库客户端62，可以是访问数据库服务的应用、程序、命令或者脚本等，通过网络向数据库引擎发起访问请求并接收处理结果，客户端采用已有技术，不需要做任何改变。
数据库引擎64，负责完成对客户端请求的业务逻辑处理。可以在数据库引擎中增加数据保护装置，该装置包括数据保护模块、策略模块，用以实现数据库引擎的敏感数据保护功能，数据保护装置内置在数据库引擎中。其中，数据保护模块可以从策略模块中获取敏感数据保护策略，执行对应的数据保护动作，例如，拒绝访问、脱敏处理、加密处理、解密处理、匿名化处理、审计、告警等。策略模块包括分类级别单元、策略管理单元、策略存储单元，为数据保护模块提供策略支撑。其中，分类分级单元用于对用户及数据进行分类分级管理，包括用户访问级别、数据安全级别、数据安全类别等。策略管理单元，负责对数据保护策略进行管理并提供策略访问接口。策略存储单元，负责存储数据保护策略。
数据库66，可以是数据实际存储的地方，一个数据库引擎可以支持多个数据库实例。当数据库引擎收到客户端的访问请求后，由接收模块对访问请求进行解析，获得的客户端访问参数，数据保护模块解析访问请求SQL并获取请求类型及受控字段列表，对受控字段列表中的每一个字段逐个执行数据保护操作；所有受控字段处理完毕后，重新合成第一SQL语句，数据库引擎执行所述第一SQL语句，将结果反馈至所述客户端。
针对SQL类数据库引擎(包括不限于Hive、SparkSQL等)，以Hive数据库例为，图7是根据本公开具体实施例的数据访问方法流程图，如图7所示，该流程包括：
步骤S702，Hive(Hive是基于hadoop的一个数据仓库工具,可以将结构化数据文件映射为一张数据库表,并提供类SQL查询功能)客户端通过网络直接向Hive数据库引擎发起SQL访问请求。
步骤S704，Hive数据库引擎获取客户端访问参数。其中，访问参数至少包括其中之一：
①原始请求，包括不限于请求SQL；
②用户身份，包括不限于用户名、用户组、角色等；
③用户访问级别；
④访问时间；
⑤网络参数，包括不限于IP地址、主机名等。
步骤S706，Hive数据库引擎的SQL解析器对原始请求中的SQL语句进行解析，构造出语 法树，将SQL进一部抽象和结构化，生成重构后的抽象语法树。
步骤S708，解析抽象语法树，解析请求SQL语句，获取SQL语句请求类型，对DQL类请求获取其顶层输出字段列表作为受控字段列表，对其他类型请求先解析出SQL语句所操作的字段，并将操作字段加入到受控字段列表。
步骤S710，判断命令类型，当命令类型为DQL类时，执行步骤S712，当命令类型为非DQL类型，执行步骤S714。
步骤S712，生成顶层输出字段列表作为受控字段列表。
以DQL类查询语句为例：
select ename,deptno,sal
from emp
where deptno＝
(select deptno from dept where loc＝'NEW YORK')；
本步骤中，获取的受控字段列表为：
emp.ename、dept.deptno、emp.sal
其中，emp，dept为数据库表名，其他为字段名；
步骤S714，获取字段名加入受控字段列表。
以DML类update语句为例：
UPDATE Customers SET ContactName＝'Alfred Schmidt',City＝'Frankfurt'
WHERE Customer ID＝1；
本步骤中，获取的受控字段列表为：
Customers.ContactName、Customers.City
其中，Customers为数据库表名，其他为字段名；
步骤S716，从受控字段列表中按预设顺序选取第一受控字段，获取所述第一受控字段对应的数据保护分类、数据安全级别及字段保护规则。
如表9所示，表9为获取到的字段保护规则的示意表格。
表9
Figure PCTCN2021106762-appb-000002
特别地，若获取所述第一受控字段的数据安全级别为空，则获取所述第一受控字段数据分类的数据安全级别作为所述第一受控字段的数据安全级别；
特别地，若获取所述第一受控字段的字段保护规则为空，则获取所述第一受控字段数据分类的字段保护规则作为所述第一受控字段的保护规则；
步骤S718，执行所述第一受控字段的字段保护规则对应的一组可信条件，根据可信条件计算结果，选择对应动作类型，执行具体保护动作因子。
步骤S720，判断动作类型，如果动作类型为拒绝执行，则执行步骤S722，如果动作类型 为脱敏处理、加密处理、解密处理、匿名化处理等，则执行步骤S724，如果动作类型为审计，则执行步骤S726。
步骤S722，直接向客户端反馈结果，退出流程。
步骤S724，根据字段保护规则中的动作因子合成新SQL语句段替换其原对应SQL语句段。
例如，对ename字段，其select语句类型的保护规则为：Selector2->Action1；执行Selector2判断，也就是判断用户访问级别值是否<数据保护级别值，如果是则执行Action1动作，即拒绝执行，否则继续执行。对sal字段，其select语句类型的保护规则为：Selector1->Action2；执行Selector1判断，也就是判断用户是否张三，如果是则执行Action2动作，即使用partialMask(sal,1，’*’,100)作为部分脱敏算法执行，这一步，将partialMask(sal,1，’*’,100)这一段SQL语句替换受控字段sal对应的抽象语法树节点原有值sal。
步骤S726，审计。
步骤S728，判断所有字段是否处理完毕，如果判断结果为是，则执行步骤S730，如果判断结果为否，则执行步骤S716。
步骤S730,遍历抽象语法树，重新合成第一SQL语句，确定所述第一SQL语句为最终执行的SQL语句。
select ename,deptno,partialMask(sal,1，’*’,100)
from emp
where deptno＝
(select deptno from dept where loc＝'NEW YORK')；
改写后的SQL语句对敏感字段sal自动进行了部分脱敏处理。
同样地，对下列SQL语句
UPDATE Customers SET ContactName＝'Alfred Schmidt',City＝'Frankfurt'
WHERE Customer ID＝1；
可以根据保护规则改写为：
UPDATE Customers SET ContactName＝Mask('Alfred Schmidt',’*’),City＝'Frankfurt'
WHERE Customer ID＝1；
其中,Mask为保护算因子，将字符串置为*。
步骤S732，数据库执行改写后的SQL语句。
步骤S734，数据库依据最终执行的SQL语句，并将处理结果反馈至所述客户端。
采用上述步骤，可以根据策略灵活有效提供字段级访问控制和攻击防御功能，支持多种命令类型，支持基于多种可信因素组合授权访问获取敏感数据，实现基于用户名、IP地址、访问时间等要素的敏感数据访问授权或者数据动态获取，可依据数据机密性级别及用户身份级别限制用户只能获取到其所允许访问的有可能是完全解密的原始数据、部分脱敏后的数据、标签数据、匿名化数据等，实现不同用户对同一敏感数据访问时进行不同的展示，从而有效阻断非法访问。同时，直接利用数据库引擎自身的处理能力，可以高效、实时、透明地保护隐私数据，用户可以完全不感知数据保护过程。
Hive数据库保存了大量敏感数据，通过设置灵活的数据保护策略，可以在客户端访问过程中透明地对Hive数据库中敏感数据进行实时保护。图8是根据本公开具体实施例的数据访问方法实行场景示意图，用于执行如下步骤：
步骤1，登录，具体地，合规管理员使用自己的账户和密码登录数据库系统；
步骤2，设置保护策略，合规管理员通过命令方式或者界面配置方式设置字段保护策略；
步骤3，用户通过客户端发起访问请求，具体地，直接向数据库引擎发起查询请求；
步骤4，执行数据保护，具体地，当数据库引擎收到客户端的访问请求后，由接收模块对访问请求进行解析，获得的客户端访问参数，数据保护模块解析访问请求SQL并获取请求类型及受控字段列表，对受控字段列表中的每一个字段逐个执行数据保护操作；所有受控字段处理完毕后，重新合成第一SQL语句，数据库引擎执行所述第一SQL语句，将结果反馈至所述客户端。
其中，步骤1-2为合规管理员所执行的，步骤3为用户执行的，步骤4为数据保护装置执行的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法。
在本实施例中还提供了一种数据访问装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图9是根据本公开实施例的数据访问装置的结构框图，如图9所示，该装置包括：
接收模块92，设置为接收用于请求对数据库中的数据进行访问的第一访问请求；
获取模块94，设置为对所述访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表；
执行模块96，设置为基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；
访问模块98，设置为基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
其中，该数据访问装置对应于图6所示的数据库引擎，所述接收模块92对应于图6所示的接收模块、所述执行模块96对应于图6中所示的数据保护模块，所述访问模块98对应于上述执行引擎。具体地，所述获取模块94对应于上述策略模块中的分类分级单元，所述访问模块98对应于上述策略模块中的策略存储单元和策略管理单元。
在一个示例性实施例中，所述获取模块94可以通过如下方式实现对所述访问请求进行解析，获取与所述第一访问请求所对应的第一受控字段列表：在所述第一访问请求为数据查询语言DQL类请求的情况下，将所述DQL类请求的顶层输出字段列表确定为所述第一受控字段 列表；在所述第一访问请求为除所述DQL类请求之外的其他请求的情况下，确定所述其他请求所操作的目标字段列表，将所述目标字段列表确定为所述第一受控字段列表。
在一个示例性实施例中，所述执行模块96可以通过如下方式实现基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果：从所述第一受控字段列表中按预设顺序选取一个受控字段作为第一受控字段；确定与所述第一受控字段对应的第一字段保护规则、数据安全分类、数据安全级别，其中，不同的字段保护规则对应不同的可信条件、请求类型及处理动作的组合，所述可信条件中包括第一访问参数对应的允许访问条件；基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段执行所述第一数据保护操作，得到所述目标结果。
在一个示例性实施例中，所述执行模块96可以通过如下方式实现基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段执行所述第一数据保护操作，得到所述目标结果：基于所获取的第一访问参数执行所述第一字段保护规则对应的一组可信条件；其中，所述第一访问参数至少包括以下之一：原始请求语句、用户身份、用户访问级别、访问时间、网络参数；根据一组可信条件执行结果确定所述第一处理动作所包括的第一动作类型和第一动作因子，其中，所述第一动作类型用于指示具体保护操作，所述第一动作因子用于指示所述具体保护动作算子名及待处理的实际参数；基于所述第一动作因子对所述第一受控字段进行保护处理，以得到所述目标结果。
在一个示例性实施例中，所述执行模块96可以通过如下方式实现基于所述第一动作因子对所述第一受控字段进行保护处理，以得到所述目标结果：在所述第一处理动作类型包括脱敏动作、加密处理动作、解密处理动作、匿名化动作以及自定义动作之一的情况下，基于所述第一动作因子将所述第一受控字段合成新的SQL语句段，以得到所述目标结果。
在一个示例性实施例中，所述装置可以设置为基于接收到的第一配置指令配置字段保护规则，其中，所述字段保护规则包括请求类型、一组可信条件以及处理动作的组合；其中，所述请求类型包括以下至少之一：数据查询语言DQL类、数据操作语言DML类；所述可信条件用于定义可信访问的基本判断单元，至少包括可信访问类型、可信访问参数名、判定操作符及参数值；所述可信访问类型包括以下至少之一：身份可信条件、级别可信条件、网络可信条件、时间可信条件；所述判定操作符包括大于、大于等于、小于等于、小于、等于、不等于；所述处理动作包括动作类型和动作因子，所述动作类型用于指示具体保护操作，所述动作因子用于指示所述具体保护动作算子名及待处理的实际参数；所述动作类型包括以下至少之一：拒绝访问、允许访问、显示原始数据、脱敏处理、加密处理、解密处理、匿名化处理、审计处理、告警处理。
在一个示例性实施例中，在所述第一访问参数中包括所述用户访问级别的情况下，所述可信条件中包括与所述用户访问级别对应的所述级别可信条件，其中，所述级别可信条件用于在确定所述用户访问级别大于或等于所述数据安全级别时，确定所述用户访问级别满足所述级别可信条件。
在一个示例性实施例中，所述装置还可以设置为基于接收到的第二配置指令配置与各受控字段对应的数据安全分类以及数据安全级别，其中，处于同一数据安全分类下的多个受控字段所对应的数据安全级别相同。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
本公开的实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
在一个示例性实施例中，上述计算机可读存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本公开的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
在一个示例性实施例中，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
本实施例中的具体示例可以参考上述实施例及示例性实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开不限制于任何特定的硬件和软件结合。
以上所述仅为本公开的优选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (11)

  1. 一种数据访问方法，包括：
    接收用于请求对数据库中的数据进行访问的第一访问请求；
    对所述第一访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表；
    基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；
    基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
  2. 根据权利要求1所述的方法，其中，对所述访问请求进行解析，获取与所述第一访问请求所对应的第一受控字段列表包括：
    在所述第一访问请求为数据查询语言DQL类请求的情况下，将所述DQL类请求的顶层输出字段列表确定为所述第一受控字段列表；
    在所述第一访问请求为除所述DQL类请求之外的其他请求的情况下，确定所述其他请求所操作的目标字段列表，将所述目标字段列表确定为所述第一受控字段列表。
  3. 根据权利要求1所述的方法，其中，基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果包括：
    从所述第一受控字段列表中按预设顺序选取一个受控字段作为第一受控字段；
    确定与所述第一受控字段对应的第一字段保护规则、数据安全分类、数据安全级别，其中，不同的字段保护规则对应不同的可信条件、请求类型及处理动作的组合，所述可信条件中包括第一访问参数对应的允许访问条件；
    基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段执行所述第一数据保护操作，得到所述目标结果。
  4. 根据权利要求3所述的方法，其中，基于所述第一字段保护规则中对应的第一处理动作对所述第一受控字段执行所述第一数据保护操作，得到所述目标结果包括：
    基于所获取的第一访问参数执行所述第一字段保护规则对应的一组可信条件；其中，所述第一访问参数至少包括以下之一：原始请求语句、用户身份、用户访问级别、访问时间、网络参数；
    根据一组可信条件执行结果确定所述第一处理动作所包括的第一动作类型和第一动作因子，其中，所述第一动作类型用于指示具体保护操作，所述第一动作因子用于指示所述具体保护动作算子名及待处理的实际参数；
    基于所述第一动作因子对所述第一受控字段进行保护处理，以得到所述目标结果。
  5. 根据权利要求4所述的方法，其中，基于所述第一动作因子对所述第一受控字段进 行保护处理，以得到所述目标结果包括：
    在所述第一处理动作类型包括脱敏动作、加密处理动作、解密处理动作、匿名化动作以及自定义动作之一的情况下，基于所述第一动作因子将所述第一受控字段合成新的SQL语句段，以得到所述目标结果。
  6. 根据权利要求3所述的方法，其中，所述方法还包括：
    基于接收到的第一配置指令配置字段保护规则，其中，所述字段保护规则包括请求类型、一组可信条件以及处理动作的组合；其中，
    所述请求类型包括以下至少之一：数据查询语言DQL类、数据操作语言DML类；
    所述可信条件用于定义可信访问的基本判断单元，至少包括可信访问类型、可信访问参数名、判定操作符及参数值；
    所述可信访问类型包括以下至少之一：身份可信条件、级别可信条件、网络可信条件、时间可信条件；
    所述判定操作符包括大于、大于等于、小于等于、小于、等于、不等于；
    所述处理动作包括动作类型和动作因子，所述动作类型用于指示具体保护操作，所述动作因子用于指示所述具体保护动作算子名及待处理的实际参数；
    所述动作类型包括以下至少之一：拒绝访问、允许访问、显示原始数据、脱敏处理、加密处理、解密处理、匿名化处理、审计处理、告警处理。
  7. 根据权利要求6所述的方法，其中，在所述第一访问参数中包括所述用户访问级别的情况下，所述可信条件中包括与所述用户访问级别对应的所述级别可信条件，其中，所述级别可信条件用于在确定所述用户访问级别大于或等于所述数据安全级别时，确定所述用户访问级别满足所述级别可信条件。
  8. 根据权利要求7所述的方法，其中，所述方法还包括：
    基于接收到的第二配置指令配置与各受控字段对应的数据安全分类以及数据安全级别，其中，处于同一数据安全分类下的多个受控字段所对应的数据安全级别相同。
  9. 一种数据访问装置，包括：
    接收模块，设置为接收用于请求对数据库中的数据进行访问的第一访问请求；
    获取模块，设置为对所述访问请求进行解析，获取与所述第一访问请求所对应的以下数据：第一访问参数、第一请求类型以及第一受控字段列表；
    执行模块，设置为基于所述第一访问参数以及所述第一请求类型对所述第一受控字段列表执行第一数据保护操作，得到目标结果；
    访问模块，设置为基于所述目标结果合成第二访问请求，并基于所述第二访问请求对所述数据库中的数据进行访问，以得到访问结果。
  10. 一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，其中， 所述计算机程序被设置为运行时执行所述权利要求1至8任一项中所述的方法。
  11. 一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至8任一项中所述的方法。
PCT/CN2021/106762 2020-07-16 2021-07-16 数据访问方法、装置、存储介质及电子装置 WO2022012669A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21842693.0A EP4184362A4 (en) 2020-07-16 2021-07-16 METHOD AND DEVICE FOR ACCESSING DATA, AS WELL AS STORAGE MEDIUM AND ELECTRONIC DEVICE
US18/016,557 US20230289464A1 (en) 2020-07-16 2021-07-16 Data access method and device, storage medium, and electronic device
JP2023502749A JP2023534263A (ja) 2020-07-16 2021-07-16 データアクセス方法、装置、記憶媒体及び電子装置

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010688666.6A CN113946839A (zh) 2020-07-16 2020-07-16 数据访问方法、装置、存储介质及电子装置
CN202010688666.6 2020-07-16

Publications (1)

Publication Number Publication Date
WO2022012669A1 true WO2022012669A1 (zh) 2022-01-20

Family

ID=79326513

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/106762 WO2022012669A1 (zh) 2020-07-16 2021-07-16 数据访问方法、装置、存储介质及电子装置

Country Status (5)

Country Link
US (1) US20230289464A1 (zh)
EP (1) EP4184362A4 (zh)
JP (1) JP2023534263A (zh)
CN (1) CN113946839A (zh)
WO (1) WO2022012669A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116506229A (zh) * 2023-06-28 2023-07-28 北京域信科技有限公司 一种数据访问方法、装置及电子设备
CN116756777A (zh) * 2023-08-14 2023-09-15 上海观安信息技术股份有限公司 数据脱敏方法及装置、计算机设备和可读存储介质
CN117370470A (zh) * 2023-12-08 2024-01-09 北京大数元科技发展有限公司 一种动态请求接口实现数据同步的系统和方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116150194B (zh) * 2023-04-21 2023-07-14 北京飞轮数据科技有限公司 数据获取方法、装置、电子设备和计算机可读介质
CN117195275B (zh) * 2023-11-08 2024-02-27 成方金融科技有限公司 数据访问方法、装置、电子设备和存储介质
CN117390658B (zh) * 2023-12-13 2024-03-05 北京宇信科技集团股份有限公司 一种数据安全引擎、数据安全访问系统和访问方法
CN117521159B (zh) * 2024-01-05 2024-05-07 浙江大华技术股份有限公司 敏感数据保护方法、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040054637A1 (en) * 2000-11-24 2004-03-18 Fumio Negoro Software synchronous specifying method, validating method, verifying method and testing method
CN106228084A (zh) * 2016-07-19 2016-12-14 北京同余科技有限公司 基于角色的敏感字段动态调整的数据保护方法和系统
CN106407843A (zh) * 2016-10-17 2017-02-15 深圳中兴网信科技有限公司 数据脱敏方法和数据脱敏装置
CN108959967A (zh) * 2018-07-16 2018-12-07 杭州安恒信息技术股份有限公司 一种防数据库敏感数据泄漏的方法及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7593942B2 (en) * 2004-12-30 2009-09-22 Oracle International Corporation Mandatory access control base
US20120011134A1 (en) * 2010-07-08 2012-01-12 Travnik Jakub Systems and methods for database query translation
CN110443059A (zh) * 2018-05-02 2019-11-12 中兴通讯股份有限公司 数据保护方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040054637A1 (en) * 2000-11-24 2004-03-18 Fumio Negoro Software synchronous specifying method, validating method, verifying method and testing method
CN106228084A (zh) * 2016-07-19 2016-12-14 北京同余科技有限公司 基于角色的敏感字段动态调整的数据保护方法和系统
CN106407843A (zh) * 2016-10-17 2017-02-15 深圳中兴网信科技有限公司 数据脱敏方法和数据脱敏装置
CN108959967A (zh) * 2018-07-16 2018-12-07 杭州安恒信息技术股份有限公司 一种防数据库敏感数据泄漏的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4184362A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116506229A (zh) * 2023-06-28 2023-07-28 北京域信科技有限公司 一种数据访问方法、装置及电子设备
CN116506229B (zh) * 2023-06-28 2023-09-12 北京域信科技有限公司 一种数据访问方法、装置及电子设备
CN116756777A (zh) * 2023-08-14 2023-09-15 上海观安信息技术股份有限公司 数据脱敏方法及装置、计算机设备和可读存储介质
CN116756777B (zh) * 2023-08-14 2023-11-03 上海观安信息技术股份有限公司 数据脱敏方法及装置、计算机设备和可读存储介质
CN117370470A (zh) * 2023-12-08 2024-01-09 北京大数元科技发展有限公司 一种动态请求接口实现数据同步的系统和方法
CN117370470B (zh) * 2023-12-08 2024-03-12 北京大数元科技发展有限公司 一种动态请求接口实现数据同步的系统和方法

Also Published As

Publication number Publication date
CN113946839A (zh) 2022-01-18
US20230289464A1 (en) 2023-09-14
EP4184362A1 (en) 2023-05-24
EP4184362A4 (en) 2023-12-27
JP2023534263A (ja) 2023-08-08

Similar Documents

Publication Publication Date Title
WO2022012669A1 (zh) 数据访问方法、装置、存储介质及电子装置
US9680876B2 (en) Method and system for protecting data flow at a mobile device
US20180285591A1 (en) Document redaction with data isolation
US8769605B2 (en) System and method for dynamically enforcing security policies on electronic files
US10666647B2 (en) Access to data stored in a cloud
US20200320219A1 (en) Distributed management of user privacy information
Kabir et al. A role-involved purpose-based access control model
US20210286890A1 (en) Systems and methods for dynamically applying information rights management policies to documents
WO2014081698A2 (en) Delegate authorization in cloud-based storage system
WO2019217031A1 (en) Contact discovery service with privacy aspect
US10210337B2 (en) Information rights management using discrete data containerization
CN111191279A (zh) 面向数据共享服务的大数据安全运行空间实现方法及系统
CN113468576B (zh) 一种基于角色的数据安全访问方法及装置
RU2546585C2 (ru) Система и способ предоставления прав доступа приложениям к файлам компьютера
US20220374540A1 (en) Field level encryption searchable database system
Gupta et al. Enabling attribute-based access control in NoSQL databases
CN111083135A (zh) 网关对数据的处理方法及安全网关
Raisian et al. Security issues model on cloud computing: A case of Malaysia
Kabir et al. A conditional role-involved purpose-based access control model
US20220092193A1 (en) Encrypted file control
EP2790123B1 (en) Generating A Data Audit Trail For Cross Perimeter Data Transfer
US20220100900A1 (en) Modifying data items
US20230315750A1 (en) Restriction-compliant data replication
US11941146B2 (en) Data privacy via cross jurisdiction container execution
US11983284B2 (en) Consent management methods

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21842693

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023502749

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021842693

Country of ref document: EP

Effective date: 20230216