WO2023078074A1 - 数据访问控制的方法和装置 - Google Patents

数据访问控制的方法和装置 Download PDF

Info

Publication number
WO2023078074A1
WO2023078074A1 PCT/CN2022/125696 CN2022125696W WO2023078074A1 WO 2023078074 A1 WO2023078074 A1 WO 2023078074A1 CN 2022125696 W CN2022125696 W CN 2022125696W WO 2023078074 A1 WO2023078074 A1 WO 2023078074A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
user
target data
business
target
Prior art date
Application number
PCT/CN2022/125696
Other languages
English (en)
French (fr)
Inventor
张剑青
罗正钦
陈兴修
田志鹏
戴亨名
Original Assignee
北京字节跳动网络技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京字节跳动网络技术有限公司 filed Critical 北京字节跳动网络技术有限公司
Priority to EP22889099.2A priority Critical patent/EP4283507A1/en
Publication of WO2023078074A1 publication Critical patent/WO2023078074A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/906—Clustering; Classification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6254—Protecting personal data, e.g. for financial or medical purposes by anonymising data, e.g. decorrelating personal data from the owner's identification

Definitions

  • Various implementations of the present disclosure relate to the computer field, and more specifically, to a method, device, device, and computer storage medium for data access control.
  • the business data that needs to be maintained is very large and complex. Due to the complexity of the internal workflow of the enterprise, the business data that the persons in charge of different businesses need to process may or may not be the same. The person in charge of the same business needs to process different data in different time periods. At present, most of the access to data by the person in charge of the business is handled in a static one-size-fits-all manner, which cannot adapt to actual business needs. Therefore, more flexible, safer, and more controllable data access control is required.
  • a method for data access control includes: receiving a data query request, where the data query request is used to represent the target data requested by the first user; obtaining the service data access capability attribute corresponding to the first user and the service security attribute corresponding to the target data; wherein, the service data access capability attribute It is used to characterize the access capability of data based on the user's business attributes in the responsible business environment; the business security attribute is used to represent the identification attribute for classifying data based on business security requirements; according to the first user's business data access capability attribute and The business security attribute of the target data, call the data access security model to determine the data query processing strategy corresponding to the data query request; and call the data query processing strategy to process the target data and generate a response message for feedback.
  • an apparatus for data access control includes: a receiving unit configured to receive a data query request, and the data query request is used to represent the target data requested by the first user; an obtaining unit configured to obtain the service data access capability attribute corresponding to the first user and obtain the target data corresponding business security attributes; among them, the business data access capability attribute is used to represent the user’s business attribute based on the data access capability in the responsible business environment; the business security attribute is used to represent the identification attribute for classifying data based on business security requirements
  • the determining unit is configured to call the data access security model to determine the data query processing strategy corresponding to the data query request according to the business data access capability attribute of the first user and the business security attribute of the target data; and the response unit is configured to call the data
  • the query processing strategy processes the target data and generates a response message for feedback.
  • an electronic device including: a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method of the first aspect.
  • a computer-readable storage medium on which one or more computer instructions are stored, wherein one or more computer instructions are executed by a processor to implement the method according to the first aspect of the present disclosure .
  • a computer program product comprising one or more computer instructions, wherein the one or more computer instructions are executed by a processor to implement the method according to the first aspect of the present disclosure.
  • Figure 1 shows a schematic diagram of an example environment for implementing some embodiments of the present disclosure
  • Figure 2 shows a flow chart of a method for data access control according to some embodiments of the present disclosure
  • FIG. 3 shows an example block diagram of an apparatus for data access control according to some embodiments of the present disclosure.
  • FIG. 4 shows a block diagram of an example device that may be used to implement embodiments of the present disclosure.
  • the person in charge of the business needs to access business data according to business needs. For example, operation and maintenance or developers can access business data to develop and maintain applications. Customer service can access business data to solve user problems.
  • the business owner's access to business data needs to be more flexibly and securely controlled. For example, it is necessary to prevent the person in charge of the business from accessing user data irrelevant to their business, so as to better protect user data.
  • Example embodiments of the present disclosure propose a method for data access control.
  • the method includes: receiving a data query request for characterizing the target data requested by the first user; obtaining the service data access capability attribute corresponding to the first user and the service security attribute corresponding to the target data; according to the service data access capability attribute of the first user and the business security attributes of the target data, call the data access security model to determine the data query processing strategy corresponding to the data query request; and call the data query processing strategy to process the target data and generate a response message for feedback.
  • user access to data can be effectively controlled by providing responses to requests based on the user's business data access capability attributes and target data's business security attributes. For example, it is possible to effectively control the access of the person in charge of the business to the business data.
  • FIG. 1 shows a schematic diagram of an example environment 100 implementing some embodiments of the present disclosure.
  • a request initiator 110 (hereinafter referred to as the initiator for short) may send a request to a data center 130 to query service data to a gateway 120 .
  • the initiator 110 of the request may be an internal employee of the enterprise, such as the person in charge of the business.
  • the originator 110 of the request may be an operator, such as a customer service interface with a customer.
  • the initiator 110 of the request may also be a product development or operation and maintenance personnel, such as a software developer.
  • the data center 130 is used to store business data.
  • Business data may include user data of an enterprise's products.
  • User data may include data of natural person users.
  • User Data may also include User Data of entities other than natural persons.
  • user data may include enterprise user data, institutional user data, and the like.
  • the service data may also include other data related to the service, such as the source code of the software product.
  • Data center 130 may be geographically located in the same country as originator 110 of the request. Data center 130 may also be geographically located in a different country than originator 110 of the request.
  • the initiator 110 of the request may be the operation and maintenance personnel of the headquarters of a multinational enterprise.
  • the data center 130 may be a data center of a subsidiary of a multinational enterprise located in another country, and the data center stores user data in that country.
  • Gateway 120 may receive the request from initiator 110 and forward the request to data center 130 .
  • Gateway 120 may receive query results returned from data center 130 and forward the query results to originator 110 of the request as a response to the request.
  • Gateway 120 can also process received requests and query results. For example, gateway 120 may verify the security credentials of originator 110 of the request and obtain some information of originator 110, such as an employee's business location. Gateway 120 may also identify originator 110 of the request based on the received request. Gateway 120 may also determine whether to forward the request to data center 130 based on the identification of originator 110 of the request. Gateway 120 may also modify query results received from data center 130 and provide the modified query results to originator 110 of the request.
  • gateway 120 is illustrative only.
  • some embodiments of the present disclosure may be implemented in the context of direct queries to databases.
  • part of the functions of the gateway 120 may be implemented by the management or control module of the data center 130 .
  • FIG. 2 shows a flowchart of an example method 200 for data access control according to some embodiments of the present disclosure.
  • the method 200 can be implemented, for example, at the gateway 120 in FIG. 1 .
  • a data query request is received, the data query request is used to characterize the first user requesting target data.
  • the first user may be a person in charge of the business, such as operation and maintenance personnel, customer service personnel, and the like.
  • first user and request initiator 110 may be used interchangeably.
  • the target data may be business-related data, such as business-related user data.
  • business data can be classified into public data, non-public data, identifiable data, unidentifiable data, temporary data, permanent data, etc.
  • Public data generally refers to the data specified by the business that is allowed to be disclosed to the outside world, or the data that is specified by the user to be allowed to be disclosed to the outside world.
  • information such as user names, nicknames, and personalized signatures of users is usually set as public data that is made public.
  • public data may include data accessible from sources other than data center 130 .
  • anyone can obtain these public data without querying the data center 130 .
  • non-public data generally refers to the data specified by the business that is not allowed to be disclosed to the outside world, or the data specified by the user that is not allowed to be disclosed to the outside world.
  • user address information is generally not disclosed to the public.
  • This type of data is only to meet the needs of business such as placing an order, and this type of data can generally be defined as non-public data.
  • Data center 130 may store non-public data for business needs.
  • the data center 130 may provide employees with non-public data for implementing product functions.
  • data center 130 may store a user's real name and phone number for authentication when the user logs in.
  • Identifiable data can refer to data that enables the identification or location of a natural person, entity or account.
  • Identifiable data may include personally identifiable information (PII). Examples of identifiable data may include an individual's name or username, user identifiers, business names, stock codes, and the like.
  • Identifiable data can also include data that effectively narrows the scope of identification, such as birthdays. Although birthdays do not uniquely identify a natural person, they can greatly narrow the scope of identification.
  • Identifiable data may include an identifier.
  • An identifier can uniquely identify a natural person, entity or account. Identifiers can be a combination of letters, numbers, and symbols. Examples of identifiers may include a user identifier (uid), an individual's identification number. In Internet products, user data can be uniquely associated with uid.
  • Non-identifiable data can refer to data that cannot be identified or located to a natural person, entity or account. For example, the number of views, likes, and comments of a user's video.
  • Temporary data can refer to data that is only valid for a limited period of time or under certain conditions. For example, temporary links, login passwords, etc. Temporary data may include user data whose association with the user will expire outside a threshold period of time, such as a temporary uid. In some implementations, a temporary uid may be assigned to the user for operation personnel to use the temporary uid to query user data. In this way, the operator can only query the user data of the user within a predetermined time period. When the temporary uid expires, the operator will no longer be able to query the user data of the user.
  • persistent data may refer to data that remains valid beyond a predetermined period of time.
  • Persistent data may include user data whose association with the user does not expire beyond a threshold period of time.
  • An example of persistent data may include a user's persistent uid. For example, all user data since account creation can be uniquely associated with a uid, and that uid remains valid until the account is deactivated.
  • a user's uid may be displayed as public data on their personal page along with their username.
  • the user's uid is stored in the data center 130 as non-public data and is not publicly accessible.
  • the service data access capability attribute corresponding to the first user and the service security attribute corresponding to the target data are acquired.
  • the business data access capability attribute is used to characterize the data access capability in the responsible business environment based on the user's business attributes.
  • the business data access capability attribute may indicate whether the initiator 110 has restricted access to data or indicate the level of restricted access.
  • the corresponding service data access capability attribute of the originator 110 of the request may be determined based on relevant information of the request. If the initiator 110 of the request is determined to be an employee with limited access to the data center 130 , the gateway 120 may not directly forward the request to the data center 130 but first analyze the request.
  • gateway 120 may determine the service data access capability attribute of originator 110 of the request based on the service type. For example, since the business of customer service requires direct communication with the user, the gateway 120 may identify the customer service personnel directly connected with the customer as the initiator 110 with unlimited access. For another example, since the business of the product developer does not need to know real user information, the gateway 120 may identify the product developer as the initiator 110 with limited access.
  • the gateway 120 may determine the business data access capability attribute of the originator 110 of the request based on geographic factors. For example, the gateway 120 may determine whether the originator 110 of the request has limited access to the data center 130 based on the originator's 110 nationality, the geographic location, and the geographic location of the data center 130 . For example, gateway 120 may identify employees who are not geographically located in the same country as data center 130 as restricted originators 110 due to data sovereignty protection requirements.
  • the gateway 120 may determine the service data access capability attribute of the initiator 110 of the request based on the manager of the data center 130 .
  • gateway 120 may identify as restricted-access originators 110 employees who do not belong to the same country as the administrator of data center 130 .
  • the manager of the data center 130 may be determined according to the data security and privacy compliance requirements of the country or region where the data center 130 is located.
  • Business security attributes are used to characterize identification attributes that classify data based on business security requirements.
  • the business security attribute may include or indicate one or more of data disclosure level, identifiable level, and time level.
  • gateway 120 may determine the business security attributes of the requested target data if originator 110 of the request is determined to be an employee with limited access to data center 130 .
  • gateway 120 can determine the business security attributes of the target data based on the disclosure level of the target data.
  • the disclosure level may indicate how easy it is to obtain the target data from sources other than data center 130 .
  • the disclosure level of public data may be higher than that of non-public data.
  • gateway 120 may determine the business security attribute of the target data based on the identifiable level of the target data.
  • the identifiable level can indicate whether the target data can identify a user, natural person or entity. For example, identifiable data may have a higher identifiable level than non-identifiable data.
  • the gateway 120 may determine the service security attribute of the target data based on the time level of the target data.
  • the temporal level may indicate whether the association between user data and the user will expire within a threshold period of time. For example, permanent data may have a higher temporal level than temporary data.
  • target data can be classified based on disclosure level, identifiable level, and temporal level.
  • the business security attributes of the target data can be determined based on classification.
  • Business security attributes may include the results of classification. For example, the business security attribute of the target data whose disclosure level exceeds a threshold and whose identifiable level exceeds a threshold may be determined as open and identifiable. Similarly, the business security attribute of the target data whose disclosure level exceeds a threshold and whose identifiable level is lower than the threshold may be determined as open and unidentifiable.
  • the business security attribute of the target data whose disclosure level is lower than the threshold and whose identifiability level exceeds the threshold may be determined as non-public and identifiable.
  • the business security attribute of the target data whose disclosure level is lower than a threshold and whose identifiable level is lower than a threshold may be determined as non-public and non-identifiable.
  • the business security attributes of the target data whose disclosure level exceeds a threshold, whose identifiable level exceeds a threshold, and whose time level exceeds a threshold may also be determined as public, identifiable, and permanent.
  • the data access security model is invoked to determine a data query processing policy corresponding to the data query request.
  • Gateway 120 may utilize the data access security model to determine different data query processing policies.
  • the data query request includes the user identifier of the first user and a keyword for querying target data (also referred to as query keyword hereinafter).
  • the data access security model may determine a corresponding data query processing policy based on the service data access capability attribute of the first user and the service security attribute of the target data.
  • Data query processing strategies may include anonymization strategies, data transparent transmission strategies, data isolation strategies, etc.
  • Anonymization policies are used to anonymize some or all of the target data.
  • the data transparent transmission strategy is used for the direct exchange of target data.
  • Data isolation policies are used to isolate target data, that is, to prohibit access to target data.
  • the data access security model may determine that the data query processing policy is a data isolation policy, that is, the first user is prohibited from querying the target data. For example, the initiator 110 may be prevented from using the username of the target user to query the non-public browsing history of the target user. In this way, user data can be better protected.
  • the data access security model can determine data query processing policies based on query rules between query keywords and target data.
  • Query rules can specify the target data that can be queried by specific types or specific query keywords.
  • Query rules can be set according to business requirements.
  • query keywords and target data can be associated with the same user.
  • the initiator 110 uses the first user data of user A as a query keyword to query the second user data of user A.
  • the initiator 110 uses the username of user A to query the browsing history of user A.
  • the data access security model can determine the data query processing strategy based on the business security attributes of the query keywords and the business security attributes of the target data. For example, when both the business security attribute of the query keyword and the business security attribute of the target data are public, the data query processing strategy can be determined as the data transparent transmission strategy. In this way, mutual checking between public data can be realized.
  • the data query processing strategy is invoked to process the target data and generate a response message for feedback.
  • the details of data access control for different policies will be described in detail below.
  • the data query strategy can be invoked to process the target data and generate a response message, and a valid time is configured for the specified data in the target data contained in the response message and a response message is fed back.
  • the valid time is used to indicate that the specified data is in Validity period for use in business.
  • a valid period of use may be configured for the password obtained from the query, so that the initiator 110 can only use the password obtained from the query within the valid period of use, thereby realizing the protection of the target data.
  • a response message may be generated and fed back according to the target data, and the response message includes the target data.
  • gateway 120 may forward the request to data center 130; receive queried target data from data center 130; and send a response including the target data to initiator 110.
  • the data access security model may determine that the data query processing policy is a data transparent transmission policy. In this case, gateway 120 may send a response to initiator 110 including the target data.
  • the data access security model can determine the data query processing strategy as the data transparent transmission strategy .
  • gateway 120 may send a response to initiator 110 including the target data.
  • the initiator 110 may query the data center 130 for the user's temporary uid by using the user's search history as a query keyword. In this way, the initiator 110 can quickly locate the user uniquely associated with the temporary uid to solve problems related to the user.
  • the initiator 110 will not be able to locate any user using the temporary uid after a threshold period of time. In this way, user data can be protected while allowing internal staff to quickly address issues.
  • the data access security model can determine the data query processing strategy as data transparent transmission Strategy.
  • gateway 120 may send a response to initiator 110 including the target data.
  • the initiator 110 may query the data center 130 for the second temporary uid of the user by using the first temporary uid as a query key.
  • the first temporary uid and the second temporary uid may be temporary identifiers assigned to users according to different business needs.
  • the first temporary uid may be a unique identifier associated with the operation business
  • the second temporary uid may be a unique identifier associated with the product development and maintenance business.
  • the engineering team can use the first temporary uid to query the data center 130 for the second temporary uid associated with the product development and maintenance business.
  • the engineering team can use the second temporary uid to locate user-related issues and resolve them.
  • the data access security model may determine that the data query processing strategy is data transparency. Pass strategy.
  • gateway 120 may send a response to initiator 110 including the target data.
  • the initiator 110 may use the above-mentioned first temporary uid as a query keyword to query the data center 130 for non-public and unidentifiable user data related to the user's problem, such as the user's recharge record.
  • the data to be protected in the target data may be anonymized, and a response message may be generated based on the anonymized target data for feedback.
  • the data to be protected in the target data may be part or all of the target data.
  • the gateway 120 may forward the request to the data center 130; receive the queried target data from the data center 130; anonymize the target data to generate anonymous data, the identifiable level of the anonymous data is lower than the identifiable level of the target data; Party 110 sends a response including anonymous data.
  • Target Data may be anonymized using any suitable method. For example, statistical techniques, cryptographic techniques, suppression techniques, pseudonymization techniques, generalization techniques, permutation techniques, and randomization techniques can be used to generate anonymous data. It should be understood that depending on the specific definition method, anonymization processing may also be referred to as de-identification processing, pseudonymization processing, and the like. Anonymized data generated by anonymization can be restored. Alternatively, anonymous data may not be restored.
  • the gateway 120 may perform anonymization processing on the target data, so as to reduce the identifiable level of the target data. In this manner, the initiator 110 cannot obtain non-public identifiable data, thereby achieving protection of the targeted data.
  • the gateway 120 may anonymize the real name. Otherwise, the initiator 110 may associate the user's behavior with the natural person corresponding to the user.
  • the gateway 120 may perform anonymization processing on the target data to reduce the identifiable level of the target data. In this way, the restricted originator 110 cannot use public data as a query key to obtain non-public data, thereby achieving access control to target data.
  • the gateway 120 may perform anonymization processing on the user's real name. Otherwise, originator 110 may associate the user to a natural person.
  • the gateway 120 may anonymize the target data to reduce the identifiable level. In this way, the originator 110 can be prevented from tracking the account by associating the user's behavior data with the account.
  • the gateway 120 may anonymize the user name. Otherwise, the initiator 110 may associate the user's behavior to the user.
  • the gateway 120 may anonymize the target data to reduce the security of the target data. identifiable level. In this manner, originator 110 may be prevented from combining temporarily identifiable data with public data to enable location of a user, account, or entity.
  • the gateway 120 may anonymize the user name. Otherwise, the initiator 110 can associate the temporary uid to the user, so that the data associated with the temporary uid can be located to the user.
  • a response message in response to the data query processing policy being a data isolation policy, may be generated and fed back, and the response message is used to indicate that the data query request is not allowed.
  • gateway 120 may send a response to originator 110 of the request indicating that the request was not approved.
  • the gateway 120 may send a response indicating that the request is not approved to the originator 110 of the request instead of sending the anonymous data to the originator 110 because the anonymous data may bring about program semantic ambiguity.
  • the gateway 120 may send a response indicating that the request is not approved to the originator 110 of the request, instead of sending 110 Send anonymous data.
  • the gateway 120 may send an indication to the originator 110 of the request that the request is not approved instead of sending anonymous data to the initiator 110.
  • the gateway 120 may send an indication to the originator 110 of the request that the request is not Approved response instead of sending anonymous data to initiator 110.
  • the gateway 120 may send an indication to the originator 110 of the request that the request is not approved instead of sending anonymous data to the initiator 110.
  • the gateway 120 may send an indication to the originator 110 of the request Instead of sending anonymous data to the originator 110, the request is not approved for a response.
  • the gateway 120 may send to the request initiator 110 Instead of sending anonymous data to the originator 110, a response indicating that the request was not approved.
  • the gateway 120 may request Instead of sending anonymous data to the originator 110, the originator 110 sends a response indicating that the request was not approved.
  • the gateway 120 may directly send a response indicating that the request is not approved to the originator 110 of the request without forwarding the request to the data center 130 . In this manner, originator 110 may be prevented from making inquiries utilizing non-public and identifiable user data obtained from other sources.
  • FIG. 3 shows a schematic structural block diagram of an apparatus 300 for data access control according to some embodiments of the present disclosure.
  • the device 300 includes: a receiving unit 310 configured to receive a data query request, the data query request being used to represent the target data requested by the first user; an obtaining unit 320 configured to obtain the service data corresponding to the first user Access capability attribute and the business security attribute corresponding to the acquisition target data; among them, the business data access capability attribute is used to represent the user's business attribute based on the data access capability in the responsible business environment; the business security attribute is used to represent the business security based The identification attribute for classifying the data is required; the determining unit 330 is configured to call the data access security model to determine the data query processing strategy corresponding to the data query request according to the business data access capability attribute of the first user and the business security attribute of the target data; And the response unit 340 is configured to invoke the data query processing strategy to process the target data and generate a response message for feedback.
  • a receiving unit 310 configured to receive a data query request, the data query request being used to represent the target data requested by the first user
  • an obtaining unit 320 configured to obtain the service data
  • the response unit 340 is configured to: when the data query processing policy corresponding to the data query request is an anonymization policy, perform anonymization processing on the data to be protected in the target data, and based on the anonymized target data Generate a response message for feedback.
  • the response unit 340 is configured to: when the data query processing strategy corresponding to the data query request is a data transparent transmission strategy, generate a response message according to the target data and give feedback, and the response message includes the target data.
  • the response unit 340 is configured to generate a response message and give feedback when the data query processing strategy corresponding to the data query request is a data isolation strategy, and the response message is used to indicate that the data query request is not allowed.
  • the data query request includes the user identifier of the first user and a keyword for querying the target data
  • the determining unit 330 is configured to: when the service data access capability attribute of the first user identifies the first user as data
  • the type of access rights is restricted and the keyword used to query the target data is the authorized public information of the second user and the business security attribute of the target data indicates that the target data is non-public
  • call the data access security model to determine the data query corresponding to the data query request
  • the processing policy is a data isolation policy, and the data isolation policy is used to prohibit the first user from querying the target data.
  • the response unit 340 is configured to: call the data query strategy to process the target data and generate a response message, configure a valid time for the specified data in the target data contained in the response message and feed back the response message, the valid time is set in It is used to indicate the validity period of the specified data in the business.
  • Fig. 4 shows a schematic block diagram of an example device 400 that may be used to implement embodiments of the present disclosure.
  • gateway 120 according to an embodiment of the present disclosure may be implemented by device 400 .
  • device 400 includes a central processing unit (CPU) 401 that can be programmed according to computer program instructions stored in read only memory (ROM) 402 or loaded from storage unit 408 into random access memory (RAM) 403 program instructions to perform various appropriate actions and processes.
  • ROM read only memory
  • RAM random access memory
  • various programs and data necessary for the operation of the device 400 can also be stored.
  • the CPU 401, ROM 402, and RAM 403 are connected to each other through a bus 404.
  • An input/output (I/O) interface 405 is also connected to bus 404 .
  • the I/O interface 405 includes: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a magnetic disk, an optical disk, etc. ; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, and the like.
  • the communication unit 409 allows the device 400 to exchange information/data with other devices over a computer network such as the Internet and/or various telecommunication networks.
  • method 200 can be executed by the processing unit 401 .
  • method 200 may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 408 .
  • part or all of the computer program may be loaded and/or installed on the device 400 via the ROM 402 and/or the communication unit 409.
  • the computer program is loaded into RAM 403 and executed by CPU 401, one or more actions of method 200 described above may be performed.
  • the present disclosure may be a method, apparatus, system and/or computer program product.
  • a computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for carrying out various aspects of the present disclosure.
  • a computer readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device.
  • a computer readable storage medium may be, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.
  • Computer-readable storage media include: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or flash memory), static random access memory (SRAM), compact disc read only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, mechanically encoded device, such as a printer with instructions stored thereon A hole card or a raised structure in a groove, and any suitable combination of the above.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • flash memory static random access memory
  • SRAM static random access memory
  • CD-ROM compact disc read only memory
  • DVD digital versatile disc
  • memory stick floppy disk
  • mechanically encoded device such as a printer with instructions stored thereon
  • a hole card or a raised structure in a groove and any suitable combination of the above.
  • computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., pulses of light through fiber optic cables), or transmitted electrical signals.
  • Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and/or a wireless network.
  • the network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers.
  • a network adapter card or a network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing/processing device .
  • Computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or Source or object code written in any combination, including object-oriented programming languages—such as Smalltalk, C++, etc., and conventional procedural programming languages—such as the “C” language or similar programming languages.
  • Computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server implement.
  • the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as via the Internet using an Internet service provider). connect).
  • LAN local area network
  • WAN wide area network
  • an electronic circuit such as a programmable logic circuit, field programmable gate array (FPGA), or programmable logic array (PLA)
  • FPGA field programmable gate array
  • PDA programmable logic array
  • These computer readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine such that when executed by the processing unit of the computer or other programmable data processing apparatus , producing an apparatus for realizing the functions/actions specified in one or more blocks in the flowchart and/or block diagram.
  • These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause computers, programmable data processing devices and/or other devices to work in a specific way, so that the computer-readable medium storing instructions includes An article of manufacture comprising instructions for implementing various aspects of the functions/acts specified in one or more blocks in flowcharts and/or block diagrams.
  • each block in a flowchart or block diagram may represent a module, a portion of a program segment, or an instruction that includes one or more Executable instructions.
  • the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations can be implemented by a dedicated hardware-based system that performs the specified function or action , or may be implemented by a combination of dedicated hardware and computer instructions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • Medical Informatics (AREA)
  • Data Mining & Analysis (AREA)
  • Automation & Control Theory (AREA)
  • Computational Linguistics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种用于数据访问控制的方法、装置、设备和存储介质，其中该方法包括：接收用于表征第一用户请求目标数据的数据查询请求（202）；获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性（204）；根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略（206）；以及调用数据查询处理策略对目标数据进行处理并生成响应消息进行反馈（208）。根据该方法，通过基于用户的业务数据访问能力属性和目标数据的业务安全属性来提供对请求的响应，可以有效地控制用户对数据的访问。

Description

数据访问控制的方法和装置
本申请要求于2021年11月05日提交中国专利局，申请号为202111306878.4，发明名称为“数据访问控制的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开的各实现方式涉及计算机领域，更具体地，涉及用于数据访问控制的方法、装置、设备和计算机存储介质。
背景技术
对于企业而言，需要维护的业务数据非常庞杂。由于企业内部的工作流程的复杂性，不同业务的负责人所需要处理的业务数据可能相同，也可能不相同。同一业务的负责人在不同时间段所需要处理的数据也不相同。目前对于业务的负责人对数据的访问大多采用静态一刀切的方式处理，无法适配实际业务需求。因此，需要更灵活、更安全、更可控的数据访问控制。
发明内容
在本公开的第一方面，提供了一种用于数据访问控制的方法。该方法包括：接收数据查询请求，数据查询请求用于表征第一用户请求目标数据；获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性；其中，业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务环境下对数据的访问能力；业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性；根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略；以及调用数据查询处理策略对目标数据进行处理并生 成响应消息进行反馈。
在本公开的第二方面中，提供了一种用于数据访问控制的装置。该装置包括：接收单元，被配置为接收数据查询请求，数据查询请求用于表征第一用户请求目标数据；获取单元，被配置为获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性；其中，业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务环境下对数据的访问能力；业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性；确定单元，被配置为根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略；以及响应单元，被配置为调用数据查询处理策略对目标数据进行处理并生成响应消息进行反馈。
在本公开的第三方面，提供了一种电子设备，包括：存储器和处理器；其中存储器用于存储一条或多条计算机指令，其中一条或多条计算机指令被处理器执行以实现根据本公开的第一方面的方法。
在本公开的第四方面，提供了一种计算机可读存储介质，其上存储有一条或多条计算机指令，其中一条或多条计算机指令被处理器执行实现根据本公开的第一方面的方法。
在本公开的第五方面，提供了一种计算机程序产品，其包括一条或多条计算机指令，其中一条或多条计算机指令被处理器执行实现根据本公开的第一方面的方法。
附图说明
结合附图并参考以下详细说明，本公开各实施例的上述和其他特征、优点及方面将变得更加明显。在附图中，相同或相似的附图标注表示相同或相似的元素，其中：
图1示出了实现本公开的一些实施例的示例环境的示意图；
图2示出了根据本公开的一些实施例的用于数据访问控制的方 法的流程图；
图3示出了根据本公开的一些实施例的用于数据访问控制的装置的示例框图；以及
图4示出了可以用来实施本公开的实施例的示例设备的框图。
具体实施方式
下面将参照附图更详细地描述本公开的实施例。虽然附图中显示了本公开的某些实施例，然而应当理解的是，本公开可以通过各种形式来实现，而且不应该被解释为限于这里阐述的实施例，相反提供这些实施例是为了更加透彻和完整地理解本公开。应当理解的是，本公开的附图及实施例仅用于示例性作用，并非用于限制本公开的保护范围。
在本公开的实施例的描述中，术语“包括”及其类似用语应当理解为开放性包含，即“包括但不限于”。术语“基于”应当理解为“至少部分地基于”。术语“一个实施例”或“该实施例”应当理解为“至少一个实施例”。术语“第一”、“第二”等等可以指代不同的或相同的对象。下文还可能包括其他明确的和隐含的定义。
如上所述，业务的负责人需要根据业务需求来访问业务数据。例如，运维或开发人员可以访问业务数据来开发维护应用。客服可以访问业务数据来解决用户的问题。然而，取决于具体业务，业务的负责人对业务数据的访问需要被更灵活、安全地控制。例如，需要防止业务的负责人访问与其业务无关的用户数据，从而更好地保护用户数据。
本公开的示例实施例提出了一种用于数据访问控制的方法。该方法包括：接收用于表征第一用户请求目标数据的数据查询请求；获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性；根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略；以及调用数据查询处理策略对目标数据进行 处理并生成响应消息进行反馈。
以此方式，通过基于用户的业务数据访问能力属性和目标数据的业务安全属性来提供对请求的响应，可以有效地控制用户对数据的访问。例如，可以有效地控制业务的负责人对业务数据的访问。
以下将参照附图来具体描述本公开的实施例。
图1示出了实现本公开的一些实施例的示例环境100的示意图。如图1所示，在环境100中，请求的发起方110(下文也简称为发起方)可以向网关120发送向数据中心130查询业务数据的请求。请求的发起方110可以是企业的内部员工，例如业务的负责人。取决于具体业务，请求的发起方110可以是运营人员，例如与客户对接的客服。请求的发起方110也可以是产品开发或运维人员，例如软件开发人员。
数据中心130用于存储业务数据。业务数据可以包括企业的产品的用户数据。用户数据可以包括自然人用户的数据。用户数据还可以包括除自然人以外的实体的用户数据。例如，用户数据可以包括企业用户数据、机构用户数据等。备选地或附加地，业务数据还可以包括与业务有关的其他数据，例如软件产品的源代码等。
数据中心130可以与请求的发起方110在地理上处于同一国家。数据中心130也可以与请求的发起方110在地理上处于不同国家。例如，请求的发起方110可以是跨国企业总部的运维人员。数据中心130可以是位于其他国家的跨国企业的子公司的数据中心，并且该数据中心存储有该国的用户数据。
请求的发起方110和数据中心130之间的通信可以借助于网关120实现。网关120可以接收发起方110的请求并且将请求转发给数据中心130。网关120可以接收从数据中心130返回的查询结果并且将查询结果转发给请求的发起方110以作为对请求的响应。
网关120还可以对所接收的请求和查询结果进行处理。例如，网关120可以验证请求的发起方110的安全凭证并且获得发起方110的一些信息，例如员工的办公地点。网关120还可以基于所接收的 请求来标识请求的发起方110。网关120还可以基于对请求的发起方110的标识来确定是否向数据中心130转发请求。网关120还可以对从数据中心130接收的查询结果进行修改并且将经修改的查询结果提供给请求的发起方110。
应理解，网关120仅是示意性的。例如，本公开的一些实施例可以被实现在对数据库的直接查询的场景中。在这种场景中，网关120的部分功能可以由数据中心130的管理或控制模块来实现。
下文将参考图2至图4来详细描述数据访问控制的原理和细节。
图2示出了根据本公开的一些实施例的用于数据访问控制的示例方法200的流程图。该方法200例如可以在图1的网关120处实施。
在框202，接收数据查询请求，该数据查询请求用于表征第一用户请求目标数据。第一用户可以是业务的负责人，例如运维人员、客服人员等。在下文中，第一用户与请求的发起方110可以互换使用。目标数据可以是业务相关的数据，例如业务相关的用户数据。
从业务的数据安全等级角度划分，业务数据可以被分类为公开数据、非公开数据、可标识数据、不可标识数据、临时数据、永久数据等。
公开数据一般是指业务上指定的允许对外公开的数据，或用户指定的允许对外公开的数据。例如，对于普通社交软件而言，用户的用户名、昵称、个性签名等信息通常是被设置为对外公开的公开数据。备选地或附加地，公开数据可以包括能够从数据中心130之外的渠道获取的数据。任何人可以获取这些公开数据而无需向数据中心130查询。
相反，非公开数据一般是指业务上指定的不允许对外公开的数据，或用户指定的不允许对外公开的数据。例如，对于电商平台而言，用户地址信息一般就是用户不对外公开的。这类数据仅仅是为了满足下单等业务的需要，这类数据一般可以定义为非公开数据。
出于业务需要，数据中心130可以存储非公开数据。数据中心 130可以向员工提供非公开数据以用于实现产品的功能。例如，数据中心130可以存储用户的真实姓名和电话号码，以用于在用户登录时进行认证。
可标识数据可以是指能够标识或定位自然人、实体或账户的数据。可标识数据可以包括个人可标识信息(PII)。可标识数据的示例可以包括个人的姓名或用户名、用户标识符、企业名称、股票代码等。可标识数据还可以包括能够有效缩小标识范围的数据，例如生日。尽管生日不能唯一地标识自然人，但是可以极大地缩小标识范围。
可标识数据可以包括标识符。标识符可以唯一地标识自然人、实体或账号。标识符可以是字母、数字和符号的组合。标识符的示例可以包括用户标识符(uid)、个人的身份证号码。在互联网产品中，用户数据可以与uid唯一地关联。
不可标识数据可以是指不能标识或定位到自然人、实体或账户的数据。例如，用户的视频的浏览量、点赞量、评论量等。
临时数据可以是指仅在有限时间段或特定条件下有效的数据。例如，临时的链接、登录密码等。临时数据可以包括与用户之间的关联在阈值时间段之外会失效的用户数据，例如临时uid。在一些实现中，可以向用户分配临时uid以供运营人员使用临时uid来查询用户数据。这样，运营人员只能在预定的时间段内查询该用户的用户数据。当临时uid失效之后，运营人员将无法再查询该用户的用户数据。
相反，永久数据可以是指在预定时间段之外仍然有效的数据。永久数据可以包括与用户之间的关联在阈值时间段之外不会失效的用户数据。永久数据的示例可以包括用户的永久uid。例如，自账户创建以来的所有用户数据可以与uid唯一关联，并且该uid在账户注销之前一直保持有效。
应理解，业务数据的分类和定义可以取决于实际应用而变化。例如，在一些实现中，用户的uid可以与用户名一起在其个人页面被 显示为公开数据。在另一些实现中，用户的uid作为非公开数据被存储在数据中心130中而不能被公开访问。
在框204，获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性。业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务环境下对数据的访问能力。业务数据访问能力属性可以指示发起方110对数据的访问是否受限或指示访问受限的水平。
可以基于请求的相关信息来确定请求的发起方110的对应的业务数据访问能力属性。如果请求的发起方110被确定为对数据中心130的访问受限的员工，则网关120可以不直接向数据中心130转发请求而是先对请求进行分析。
对于请求的发起方110的业务数据访问能力属性的确定取决于具体的业务场景。在一些实现中，网关120可以基于业务类型来确定请求的发起方110的业务数据访问能力属性。例如，由于客服的业务需要与用户直接沟通，网关120可以将与客户直接对接的客服人员标识为访问不受限的发起方110。又例如，由于产品的开发人员的业务不需要知晓真实的用户信息，网关120可以将产品的开发人员标识为访问受限的发起方110。
备选地或附加地，网关120可以基于地理因素来确定请求的发起方110的业务数据访问能力属性。例如，网关120可以基于发起人110的国籍、地理位置、数据中心130的地理位置来确定请求的发起方110对数据中心130的访问是否受限。例如，由于数据主权保护的要求，网关120可以将地理上与数据中心130不在同一国家的员工标识为受限的发起方110。
备选地或附加地，网关120可以基于数据中心130的管理方来确定请求的发起方110的业务数据访问能力属性。例如，网关120可以将与数据中心130的管理方不属于同一国家的员工标识为访问受限的发起方110。数据中心130的管理方可以按照数据中心130所在国家或地区的数据安全隐私合规的要求来确定。
业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性。业务安全属性可以包括或指示数据的公开级别、可标识级别、时间级别中的一项或多项。在一些实现中，如果请求的发起方110被确定为对数据中心130的访问受限的员工，网关120可以确定所请求的目标数据的业务安全属性。
在一些实现中，网关120可以基于目标数据的公开级别来确定目标数据的业务安全属性。如上所述，公开级别可以指示从数据中心130之外的渠道获得该目标数据的难易程度。例如，公开数据的公开级别可以高于非公开数据的公开级别。
备选地或附加地，网关120可以基于目标数据的可标识级别来确定目标数据的业务安全属性。可标识级别可以指示目标数据是否能够标识用户、自然人或实体。例如，可标识数据的可标识级别可以高于不可标识数据的可标识级别。
备选地或附加地，网关120可以基于目标数据的时间级别来确定目标数据的业务安全属性。时间级别可以指示用户数据与用户之间的关联在阈值时间段内是否会失效。例如，永久数据的时间级别可以高于临时数据的时间级别。
在一些实现中，可以基于公开级别、可标识级别和时间级别来对目标数据进行分类。可以基于分类来确定目标数据的业务安全属性。业务安全属性可以包括分类的结果。例如，可以将公开级别超过阈值并且可标识级别超过阈值的目标数据的业务安全属性确定为公开且可标识。类似地，可以将公开级别超过阈值并且可标识级别低于阈值的目标数据的业务安全属性确定为公开且不可标识。
可以将公开级别低于阈值并且可标识级别超过阈值的目标数据的业务安全属性确定为非公开且可标识。可以将公开级别低于阈值并且可标识级别低于阈值的目标数据的业务安全属性确定为非公开且不可标识。还可以将公开级别超过阈值、可标识级别超过阈值、并且时间级别超过阈值的目标数据的业务安全属性确定为公开、可标识以及永久。
在框206，根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略。网关120可以利用数据访问安全模型来确定不同的数据查询处理策略。
在一些实现中，数据查询请求中包括第一用户的用户标识以及用于查询目标数据的关键字(下文中也称为查询关键字)。数据访问安全模型可以基于第一用户的业务数据访问能力属性和目标数据的业务安全属性来确定相应的数据查询处理策略。数据查询处理策略可以包括匿名化策略、数据透传策略、数据隔离策略等。匿名化策略用于对目标数据中的部分或所有进行匿名化处理。数据透传策略用于目标数据的直接交换。数据隔离策略用于目标数据的隔离，也即禁止对目标数据的访问。
在一些实现中，当第一用户的业务数据访问能力属性标识第一用户为数据访问权利受限制类型且查询关键字为第二用户(下文中也称为目标用户)的授权公开信息且目标数据的业务安全属性标识目标数据为非公开时，数据访问安全模型可以确定数据查询处理策略为数据隔离策略，也即，禁止第一用户查询目标数据。例如，可以防止发起方110利用目标用户的用户名来查询目标用户的非公开的浏览历史。这样，可以更好地保护用户数据。
在一些实现中，数据访问安全模型可以基于查询关键字与目标数据之间的查询规则来确定数据查询处理策略。查询规则可以指定特定类型或特定的查询关键字可以查询的目标数据。查询规则可以根据业务需求而设置。
在一些实现中，查询关键字和目标数据可以关联于同一用户。换言之，发起方110利用用户A的第一用户数据作为查询关键字来查询用户A的第二用户数据。例如，发起方110利用用户A的用户名来查询用户A的浏览历史。
在这种实现中，数据访问安全模型可以基于查询关键字的业务安全属性和目标数据的业务安全属性来确定数据查询处理策略。例 如，当查询关键字的业务安全属性和目标数据的业务安全属性均为公开时，可以确定数据查询处理策略为数据透传策略。以此方式，可以实现公开数据之间的互查。
在框208，调用数据查询处理策略对目标数据进行处理并生成响应消息进行反馈。下文将详细描述不同策略的数据访问控制的细节。
在一些实现中，可以调用数据查询策略对目标数据进行处理并生成响应消息，并且针对响应消息中包含的目标数据中的指定数据配置有效时间并反馈响应消息，该有效时间用于指示指定数据在业务中的使用有效期。例如，可以为查询得到的密码配置使用有效期，这样，发起方110仅能在使用有效期内利用查询得到的密码，从而可以实现对目标数据的保护。
在一些实现中，响应于数据查询处理策略为数据透传策略，可以根据目标数据生成响应消息并进行反馈，响应消息中包含目标数据。例如，网关120可以向数据中心130转发请求；从数据中心130接收查询到的目标数据；以及向发起方110发送包括目标数据的响应。
在一些实现中，当目标数据的业务安全属性为公开并且请求中用于查询目标数据的查询关键字的业务安全属性为公开时，数据访问安全模型可以确定数据查询处理策略为数据透传策略。在这种情况下，网关120可以向发起方110发送包括目标数据的响应。
备选地或附加地，当目标数据的业务安全属性为非公开并且临时，查询关键字的业务安全属性为非公开且不可识别时，数据访问安全模型可以确定数据查询处理策略为数据透传策略。在这种情况下，网关120可以向发起方110发送包括目标数据的响应。例如，发起方110可以利用用户的搜索历史作为查询关键字向数据中心130查询用户的临时uid。这样，发起方110可以快速定位到与临时uid唯一关联的用户，以解决与该用户有关的问题。同时，由于所使用的是临时uid而不是永久uid，发起方110在阈值时间段之后将不能利用该临时uid定位到任何用户。以此方式，可以在允许内部员工 快速处理问题的同时保护用户数据。
备选地或附加地，在目标数据的业务安全属性为非公开并且临时，查询关键字的业务安全属性为非公开并且临时的情况下，数据访问安全模型可以确定数据查询处理策略为数据透传策略。在这种情况下，网关120可以向发起方110发送包括目标数据的响应。例如，发起方110可以利用第一临时uid作为查询关键字向数据中心130查询用户的第二临时uid。
第一临时uid和第二临时uid可以是根据不同的业务需要而分配给用户的临时标识符。第一临时uid可以是与运营业务关联的唯一标识符，第二临时uid可以是与产品开发维护业务关联的唯一标识符。第一临时uid和第二临时uid以及永久uid之间存在对应的映射关系。例如，当客服人员将与用户有关的问题反映给工程团队时，工程团队所接收的不是用户的永久uid而是第一临时uid。工程团队可以利用第一临时uid向数据中心130查询与产品开发维护业务关联的第二临时uid。工程团队可以使用第二临时uid来定位与用户有关的问题，从而解决问题。
备选地或附加地，在查询关键字的业务安全属性为非公开并且临时、目标数据的业务安全属性为非公开并且不可识别的情况下，数据访问安全模型可以确定数据查询处理策略为数据透传策略。在这种情况下，网关120可以向发起方110发送包括目标数据的响应。例如，发起方110可以利用上述第一临时uid作为查询关键字向数据中心130查询与用户的问题有关的非公开并且不可识别的用户数据，例如用户的充值记录。
以此方式，通过使客服人员和产品开发维护人员利用临时uid来处理对应的业务，可以防止内部员工将用户的问题定位到真实的用户或自然人。此外，客服人员和产品开发维护人员也不能利用临时uid来追踪用户的行为数据，这样可以更好地保护用户数据。
在一些实现中，响应于数据查询处理策略为匿名化策略，可以对目标数据中的待保护数据进行匿名化处理，并基于匿名化处理后 的目标数据生成响应消息进行反馈。目标数据中的待保护数据可以是目标数据的一部分或全部。
例如，网关120可以向数据中心130转发请求；从数据中心130接收查询到的目标数据；匿名化目标数据以生成匿名数据，匿名数据的可标识级别低于目标数据的可标识级别；以及向发起方110发送包括匿名数据的响应。
可以使用任何合适的方法来对目标数据进行匿名化处理。例如，可以使用统计技术、密码技术、抑制技术、假名化技术、泛化技术、置换技术和随机化技术等来生成匿名数据。应理解，取决于具体的定义方式，匿名化处理也可以称为去标识化处理、假名化处理等。经匿名化生成的匿名数据可以被还原。备选地，匿名数据也可以不能被还原。
当目标数据的业务安全属性为非公开且可识别时，网关120可以对目标数据进行匿名化处理，以降低目标数据的可标识级别。以此方式，发起方110不能获得非公开的可识别数据，从而实现对目标数据的保护。
例如，当发起方110利用非公开且不可识别的数据，例如搜索历史，来查询对应的用户真实姓名时，网关120可以对真实姓名进行匿名化处理。否则，发起方110可以将用户的行为关联到用户对应的自然人。
备选地或附加地，当目标数据的业务安全属性为非公开而查询关键字的业务安全属性为公开时，网关120可以对目标数据进行匿名化处理，以降低目标数据的可标识级别。以此方式，受限的发起方110不能使用公开数据作为查询关键字来获得非公开数据，从而实现对目标数据的访问控制。
例如，当发起方110利用公开数据，例如用户名，来查询对应的用户真实姓名时，网关120可以对用户真实姓名进行匿名化处理。否则，发起方110可以将用户关联到自然人。
备选地或附加地，当目标数据的业务安全属性为公开而查询关 键字的业务安全属性为非公开且不可识别时，网关120可以对目标数据进行匿名化处理，以降低目标数据的可标识级别。以此方式，可以防止发起方110通过将用户的行为数据与账户关联来实现对账户的追踪。
例如，当发起方110利用非公开且不可识别的数据，例如搜索历史，来查询对应的用户名时，网关120可以对用户名进行匿名化处理。否则，发起方110可以将用户的行为关联到用户。
备选地或附加地，当目标数据的业务安全属性为公开而查询关键字的业务安全属性为非公开、临时以及可识别时，网关120可以对目标数据进行匿名化处理，以降低目标数据的可标识级别。以此方式，可以防止发起方110将临时可识别数据与公开数据组合以实现对用户、账号或实体的定位。
例如，当发起方110利用临时uid来查询对应的用户名时，网关120可以对用户名进行匿名化处理。否则，发起方110可以将临时uid关联到用户，从而可以将与临时uid关联的数据定位到用户。
在一些实现中，响应于数据查询处理策略为数据隔离策略，可以生成响应消息并进行反馈，该响应消息用于表征数据查询请求不被允许。例如，网关120可以向请求的发起方110发送指示请求未被批准的响应。
在一些实现中，由于匿名数据有可能带来程序语义上的歧义，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
例如，当查询关键字的业务安全属性为公开且可识别而目标数据的业务安全属性为非公开时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为公开且不可识别而目标数据的业务安全属性为非公开且不可识别时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为公开且不可识别而目标数据的业务安全属性为非公开、临时且可识别时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为非公开且不可识别而目标数据的业务安全属性为公开且不可识别时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为非公开且不可识别而目标数据的业务安全属性为公开并且目标数据是永久标识符时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为非公开并且查询关键字是临时标识符、目标数据的业务安全属性为公开且不可标识时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
备选地或附加地，当查询关键字的业务安全属性为非公开并且查询关键字是临时标识符、目标数据的业务安全属性为公开并且目标数据是永久标识符时，网关120可以向请求的发起方110发送指示请求未被批准的响应，而不是向发起方110发送匿名数据。
附加地，当查询关键字的业务安全属性为非公开且可识别时，网关120可以直接向请求的发起方110发送指示请求未被批准的响应，而无需向数据中心130转发请求。以此方式，可以防止发起方110利用从其他渠道获得的非公开且可识别的用户数据进行查询。
上文参考图2详细描述了数据访问控制的原理和细节。应理解，上述查询关键字与目标数据之间的查询规则仅是示例性的，查询规则还可以取决于具体业务而变化。
本公开的实施例还提供了用于实现上述方法或过程的相应装置。图3示出了根据本公开的一些实施例的用于数据访问控制的装 置300的示意性结构框图。
如图3所示，装置300包括：接收单元310，被配置为接收数据查询请求，数据查询请求用于表征第一用户请求目标数据；获取单元320，被配置为获取第一用户对应的业务数据访问能力属性以及获取目标数据对应的业务安全属性；其中，业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务环境下对数据的访问能力；业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性；确定单元330，被配置为根据第一用户的业务数据访问能力属性和目标数据的业务安全属性，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略；以及响应单元340，被配置为调用数据查询处理策略对目标数据进行处理并生成响应消息进行反馈。
在一些实现中，响应单元340被配置为：当数据查询请求对应的数据查询处理策略为匿名化策略，则对目标数据中的待保护数据进行匿名化处理，并基于匿名化处理后的目标数据生成响应消息进行反馈。
在一些实现中，响应单元340被配置为：当数据查询请求对应的数据查询处理策略为数据透传策略，则根据目标数据生成响应消息并进行反馈，响应消息中包含目标数据。
在一些实现中，响应单元340被配置为：当数据查询请求对应的数据查询处理策略为数据隔离策略，则生成响应消息并进行反馈，响应消息用于表征数据查询请求不被允许。
在一些实现中，数据查询请求中包括第一用户的用户标识以及用于查询目标数据的关键字，并且确定单元330被配置为：当第一用户的业务数据访问能力属性标识第一用户为数据访问权利受限制类型且用于查询目标数据的关键字为第二用户的授权公开信息且目标数据的业务安全属性标识目标数据为非公开时，调用数据访问安全模型确定数据查询请求对应的数据查询处理策略为数据隔离策略，数据隔离策略用于禁止第一用户查询目标数据。
在一些实现中，响应单元340被配置为：调用数据查询策略对目标数据进行处理并生成响应消息，且针对响应消息中包含的目标数据中的指定数据配置有效时间并反馈响应消息，有效时间用于指示指定数据在业务中的使用有效期。
图4示出了可以用来实施本公开内容的实施例的示例设备400的示意性框图。例如，根据本公开实施例的网关120可以由设备400来实施。如图所示，设备400包括中央处理单元(CPU)401，其可以根据存储在只读存储器(ROM)402中的计算机程序指令或者从存储单元408加载到随机访问存储器(RAM)403中的计算机程序指令，来执行各种适当的动作和处理。在RAM 403中，还可存储设备400操作所需的各种程序和数据。CPU 401、ROM 402以及RAM403通过总线404彼此相连。输入/输出(I/O)接口405也连接至总线404。
设备400中的多个部件连接至I/O接口405，包括：输入单元406，例如键盘、鼠标等；输出单元407，例如各种类型的显示器、扬声器等；存储单元408，例如磁盘、光盘等；以及通信单元409，例如网卡、调制解调器、无线通信收发机等。通信单元409允许设备400通过诸如因特网的计算机网络和/或各种电信网络与其他设备交换信息/数据。
上文所描述的各个过程和处理，例如方法200，可由处理单元401执行。例如，在一些实施例中，方法200可被实现为计算机软件程序，其被有形地包含于机器可读介质，例如存储单元408。在一些实施例中，计算机程序的部分或者全部可以经由ROM 402和/或通信单元409而被载入和/或安装到设备400上。当计算机程序被加载到RAM 403并由CPU 401执行时，可以执行上文描述的方法200的一个或多个动作。
本公开可以是方法、装置、系统和/或计算机程序产品。计算机程序产品可以包括计算机可读存储介质，其上载有用于执行本公开的各个方面的计算机可读程序指令。
计算机可读存储介质可以是可以保持和存储由指令执行设备使用的指令的有形设备。计算机可读存储介质例如可以是但不限于电存储设备、磁存储设备、光存储设备、电磁存储设备、半导体存储设备或者上述的任意合适的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、静态随机存取存储器(SRAM)、便携式压缩盘只读存储器(CD-ROM)、数字多功能盘(DVD)、记忆棒、软盘、机械编码设备、例如其上存储有指令的打孔卡或凹槽内凸起结构、以及上述的任意合适的组合。这里所使用的计算机可读存储介质不被解释为瞬时信号本身，诸如无线电波或者其他自由传播的电磁波、通过波导或其他传输媒介传播的电磁波(例如，通过光纤电缆的光脉冲)、或者通过电线传输的电信号。
这里所描述的计算机可读程序指令可以从计算机可读存储介质下载到各个计算/处理设备，或者通过网络、例如因特网、局域网、广域网和/或无线网下载到外部计算机或外部存储设备。网络可以包括铜传输电缆、光纤传输、无线传输、路由器、防火墙、交换机、网关计算机和/或边缘服务器。每个计算/处理设备中的网络适配卡或者网络接口从网络接收计算机可读程序指令，并转发该计算机可读程序指令，以供存储在各个计算/处理设备中的计算机可读存储介质中。
用于执行本公开操作的计算机程序指令可以是汇编指令、指令集架构(ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码，所述编程语言包括面向对象的编程语言—诸如Smalltalk、C++等，以及常规的过程式编程语言—诸如“C”语言或类似的编程语言。计算机可读程序指令可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计 算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络—包括局域网(LAN)或广域网(WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。在一些实施例中，通过利用计算机可读程序指令的状态信息来个性化定制电子电路，例如可编程逻辑电路、现场可编程门阵列(FPGA)或可编程逻辑阵列(PLA)，该电子电路可以执行计算机可读程序指令，从而实现本公开的各个方面。
这里参照根据本公开实施例的方法、装置(系统)和计算机程序产品的流程图和/或框图描述了本公开的各个方面。应当理解，流程图和/或框图的每个方框以及流程图和/或框图中各方框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其它可编程数据处理装置的处理单元，从而生产出一种机器，使得这些指令在通过计算机或其它可编程数据处理装置的处理单元执行时，产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中，这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作，从而，存储有指令的计算机可读介质则包括一个制造品，其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其它可编程数据处理装置、或其它设备上，使得在计算机、其它可编程数据处理装置或其它设备上执行一系列操作步骤，以产生计算机实现的过程，从而使得在计算机、其它可编程数据处理装置、或其它设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本公开的多个实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。 在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分，所述模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
以上已经描述了本公开的各实施方式，上述说明是示例性的，并非穷尽性的，并且也不限于所披露的各实施方式。在不偏离所说明的各实施方式的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择，旨在最好地解释各实施方式的原理、实际应用或对市场中的技术的改进，或者使本技术领域的其他普通技术人员能理解本文披露的各实施方式。

Claims (14)

  1. 一种用于数据访问控制的方法，其特征在于，包括：
    接收数据查询请求，所述数据查询请求用于表征第一用户请求目标数据；
    获取所述第一用户对应的业务数据访问能力属性以及获取所述目标数据对应的业务安全属性；其中，所述业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务环境下对数据的访问能力；所述业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性；
    根据所述第一用户的业务数据访问能力属性和所述目标数据的业务安全属性，调用数据访问安全模型确定所述数据查询请求对应的数据查询处理策略；以及
    调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反馈。
  2. 根据权利要求1所述的方法，其特征在于，所述调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反馈，包括：
    当所述数据查询请求对应的数据查询处理策略为匿名化策略，则对所述目标数据中的待保护数据进行匿名化处理，并基于所述匿名化处理后的目标数据生成响应消息进行反馈。
  3. 根据权利要求1所述的方法，其特征在于，所述调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反馈，包括：
    当所述数据查询请求对应的数据查询处理策略为数据透传策略，则根据所述目标数据生成响应消息并进行反馈，所述响应消息中包含所述目标数据。
  4. 根据权利要求1所述的方法，其特征在于，所述调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反 馈，包括：
    当所述数据查询请求对应的数据查询处理策略为数据隔离策略，则生成响应消息并进行反馈，所述响应消息用于表征所述数据查询请求不被允许。
  5. 根据权利要求1所述的方法，其特征在于，所述数据查询请求中包括所述第一用户的用户标识以及用于查询所述目标数据的关键字；
    则根据所述第一用户的业务数据访问能力属性和所述目标数据的业务安全属性，调用数据访问安全模型确定所述数据查询请求对应的数据查询处理策略，包括：
    当所述第一用户的业务数据访问能力属性标识所述第一用户为数据访问权利受限制类型且所述用于查询所述目标数据的关键字为第二用户的授权公开信息且所述目标数据的业务安全属性标识所述目标数据为非公开时，调用数据访问安全模型确定所述数据查询请求对应的数据查询处理策略为数据隔离策略，所述数据隔离策略用于禁止所述第一用户查询所述目标数据。
  6. 根据权利要求1所述的方法，其特征在于，所述调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反馈，包括：
    调用所述数据查询策略对所述目标数据进行处理并生成响应消息，且针对所述响应消息中包含的所述目标数据中的指定数据配置有效时间并反馈所述响应消息，所述有效时间用于指示所述指定数据在业务中的使用有效期。
  7. 一种用于数据访问控制的装置，其特征在于，包括：
    接收单元，被配置为接收数据查询请求，所述数据查询请求用于表征第一用户请求目标数据；
    获取单元，被配置为获取所述第一用户对应的业务数据访问能力属性以及获取所述目标数据对应的业务安全属性；其中，所述业务数据访问能力属性用于表征基于用户的业务属性在所负责的业务 环境下对数据的访问能力；所述业务安全属性用于表征基于业务安全需求对数据进行分类的标识属性；
    确定单元，被配置为根据所述第一用户的业务数据访问能力属性和所述目标数据的业务安全属性，调用数据访问安全模型确定所述数据查询请求对应的数据查询处理策略；以及
    响应单元，被配置为调用所述数据查询处理策略对所述目标数据进行处理并生成响应消息进行反馈。
  8. 根据权利要求7所述的装置，其特征在于，所述响应单元被配置为：
    当所述数据查询请求对应的数据查询处理策略为匿名化策略，则对所述目标数据中的待保护数据进行匿名化处理，并基于所述匿名化处理后的目标数据生成响应消息进行反馈。
  9. 根据权利要求7所述的装置，其特征在于，所述响应单元被配置为：
    当所述数据查询请求对应的数据查询处理策略为数据透传策略，则根据所述目标数据生成响应消息并进行反馈，所述响应消息中包含所述目标数据。
  10. 根据权利要求7所述的装置，其特征在于，所述响应单元被配置为：
    当所述数据查询请求对应的数据查询处理策略为数据隔离策略，则生成响应消息并进行反馈，所述响应消息用于表征所述数据查询请求不被允许。
  11. 根据权利要求7所述的装置，其特征在于，所述数据查询请求中包括所述第一用户的用户标识以及用于查询所述目标数据的关键字，所述确定单元被配置为：
    当所述第一用户的业务数据访问能力属性标识所述第一用户为数据访问权利受限制类型且所述用于查询所述目标数据的关键字为第二用户的授权公开信息且所述目标数据的业务安全属性标识所述目标数据为非公开时，调用数据访问安全模型确定所述数据查询请 求对应的数据查询处理策略为数据隔离策略，所述数据隔离策略用于禁止所述第一用户查询所述目标数据。
  12. 根据权利要求7所述的装置，其特征在于，所述响应单元被配置为：
    调用所述数据查询策略对所述目标数据进行处理并生成响应消息，且针对所述响应消息中包含的所述目标数据中的指定数据配置有效时间并反馈所述响应消息，所述有效时间用于指示所述指定数据在业务中的使用有效期。
  13. 一种电子设备，包括：
    存储器和处理器；
    其中所述存储器用于存储一条或多条计算机指令，其中所述一条或多条计算机指令被所述处理器执行以实现根据权利要求1至6中任一项所述的方法。
  14. 一种计算机可读存储介质，其上存储有一条或多条计算机指令，其中所述一条或多条计算机指令被处理器执行以实现根据权利要求1至6中任一项所述的方法。
PCT/CN2022/125696 2021-11-05 2022-10-17 数据访问控制的方法和装置 WO2023078074A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22889099.2A EP4283507A1 (en) 2021-11-05 2022-10-17 Method and apparatus for data access control

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111306878.4 2021-11-05
CN202111306878.4A CN116089661A (zh) 2021-11-05 2021-11-05 数据访问控制的方法和装置

Publications (1)

Publication Number Publication Date
WO2023078074A1 true WO2023078074A1 (zh) 2023-05-11

Family

ID=86185542

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125696 WO2023078074A1 (zh) 2021-11-05 2022-10-17 数据访问控制的方法和装置

Country Status (4)

Country Link
US (1) US11669632B2 (zh)
EP (1) EP4283507A1 (zh)
CN (1) CN116089661A (zh)
WO (1) WO2023078074A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116701615B (zh) * 2023-08-08 2023-11-03 建信金融科技有限责任公司 业务文档在线管理方法、装置、电子设备及可读存储介质
CN117252676B (zh) * 2023-11-20 2024-02-02 成都新希望金融信息有限公司 业务处理方法、装置、电子设备和指标策略系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7437362B1 (en) * 2003-11-26 2008-10-14 Guardium, Inc. System and methods for nonintrusive database security
CN101453460A (zh) * 2007-12-07 2009-06-10 华为技术有限公司 一种访问控制方法及通讯系统以及相关设备
CN104660578A (zh) * 2014-04-22 2015-05-27 董唯元 一种实现数据安全存储及数据访问控制的系统及其方法
CN105357201A (zh) * 2015-11-12 2016-02-24 中国科学院信息工程研究所 一种对象云存储访问控制方法和系统
US20180025174A1 (en) * 2016-07-21 2018-01-25 Salesforce.Com, Inc. Access controlled queries against user data in a datastore
CN109117668A (zh) * 2018-08-10 2019-01-01 广东工业大学 一种基于区块链构建的身份授权安全访问方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7774365B2 (en) * 2004-08-31 2010-08-10 Morgan Stanley Organizational reference data and entitlement system
US9015301B2 (en) * 2007-01-05 2015-04-21 Digital Doors, Inc. Information infrastructure management tools with extractor, secure storage, content analysis and classification and method therefor
US8306999B2 (en) * 2007-03-23 2012-11-06 Sas Institute Inc. Computer-implemented systems, methods, and computer program product for providing row-level security in a database network
US9305180B2 (en) * 2008-05-12 2016-04-05 New BIS Luxco S.à r.l Data obfuscation system, method, and computer implementation of data obfuscation for secret databases
US9002803B2 (en) * 2011-06-07 2015-04-07 Workday, Inc. Role-based security policy for an object-oriented database system
US8914323B1 (en) * 2014-04-10 2014-12-16 Sqrrl Data, Inc. Policy-based data-centric access control in a sorted, distributed key-value data store
US10909258B2 (en) * 2018-04-30 2021-02-02 Oracle International Corporation Secure data management for a network of nodes

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7437362B1 (en) * 2003-11-26 2008-10-14 Guardium, Inc. System and methods for nonintrusive database security
CN101453460A (zh) * 2007-12-07 2009-06-10 华为技术有限公司 一种访问控制方法及通讯系统以及相关设备
CN104660578A (zh) * 2014-04-22 2015-05-27 董唯元 一种实现数据安全存储及数据访问控制的系统及其方法
CN105357201A (zh) * 2015-11-12 2016-02-24 中国科学院信息工程研究所 一种对象云存储访问控制方法和系统
US20180025174A1 (en) * 2016-07-21 2018-01-25 Salesforce.Com, Inc. Access controlled queries against user data in a datastore
CN109117668A (zh) * 2018-08-10 2019-01-01 广东工业大学 一种基于区块链构建的身份授权安全访问方法

Also Published As

Publication number Publication date
EP4283507A1 (en) 2023-11-29
US20230145130A1 (en) 2023-05-11
CN116089661A (zh) 2023-05-09
US11669632B2 (en) 2023-06-06

Similar Documents

Publication Publication Date Title
EP3854047B1 (en) Supervised learning system for identity compromise risk computation
US11238153B2 (en) Systems and methods of cloud encryption
US10498772B2 (en) Method and system for digital privacy management
JP6549328B2 (ja) 活動記録を匿名化する方法及びシステム
WO2023078074A1 (zh) 数据访问控制的方法和装置
US20170295199A1 (en) Techniques for cloud security monitoring and threat intelligence
US9639678B2 (en) Identity risk score generation and implementation
US20130332985A1 (en) Obligation system for enterprise environments
JP2012009027A (ja) 動的アクセスコントロールを用いるポリシーの生成
US20160036841A1 (en) Database Queries Integrity and External Security Mechanisms in Database Forensic Examinations
US11244040B2 (en) Enforcement of password uniqueness
US20210303720A1 (en) Access controls for a dedicated database system storing user-generated content input to a multitenant service of a collaborative work environment
US10445514B1 (en) Request processing in a compromised account
US11630895B2 (en) System and method of changing the password of an account record under a threat of unlawful access to user data
KR101320515B1 (ko) SaaS 기반 서비스에서 개인정보 보호를 위한 보안정책 관리 시스템 및 그 방법
US20230005391A1 (en) Polymorphic encryption for security of a data vault
Kaur et al. Enhancing Features of Cloud Computing Using Cloud Access Security Brokers to Avoid Data Breaches
Stingl et al. Health records and the cloud computing paradigm from a privacy perspective
Beleuta Data privacy and security in Business Intelligence and Analytics
US11983284B2 (en) Consent management methods
AlSadoon Comparisons and Appropriate Solutions to Prevent Data Threats of Cloud Computing, Applied in Green Environment
EP3674933A1 (en) System and method of changing the password of an account record under a threat of unlawful access to user data
Grandison et al. Simultaneously supporting privacy and auditing in cloud computing systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22889099

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022889099

Country of ref document: EP

Effective date: 20230821