WO2024027328A1 - 基于零信任数据访问控制系统的数据处理方法 - Google Patents

基于零信任数据访问控制系统的数据处理方法 Download PDF

Info

Publication number
WO2024027328A1
WO2024027328A1 PCT/CN2023/098357 CN2023098357W WO2024027328A1 WO 2024027328 A1 WO2024027328 A1 WO 2024027328A1 CN 2023098357 W CN2023098357 W CN 2023098357W WO 2024027328 A1 WO2024027328 A1 WO 2024027328A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
policy
data access
access
access control
Prior art date
Application number
PCT/CN2023/098357
Other languages
English (en)
French (fr)
Inventor
白日
Original Assignee
盈适慧众(上海)信息咨询合伙企业(有限合伙)
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 盈适慧众(上海)信息咨询合伙企业(有限合伙) filed Critical 盈适慧众(上海)信息咨询合伙企业(有限合伙)
Publication of WO2024027328A1 publication Critical patent/WO2024027328A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/105—Arrangements for software license management or administration, e.g. for managing licenses at corporate level
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • This application belongs to the field of data processing research, and specifically relates to a data processing method based on a zero-trust data access control system.
  • this application provides a data processing method based on a zero-trust data access control system, which flexibly configures data based on business logic by obtaining access control-related context information on the application side. access policy, and finally execute the constructed data access policy to achieve dynamic and refined access control of data.
  • the method in this manual further moves the breadth of zero-trust access control from the application side to the control side of data access (i.e., the "zero-trust data access control system" in this manual).
  • the scope of zero-trust access control is The granularity is further refined from the application level to the business logic level, and the technology is implemented by building and executing data access policies based on business logic to solve the problem that data access control cannot be extended under the current zero-trust system and traditional Address issues such as insufficient granularity in product access control and the inability to dynamically and flexibly configure hard-coded software.
  • this specification provides a data processing method based on a zero-trust data access control system.
  • the method includes:
  • the policy elements are used according to the business logic to generate an alternative strategy corresponding to the business unit; wherein the alternative strategy is available when processing its corresponding business unit.
  • the context information includes subject information of the access subject that triggers the data access request, and the access object targeted by the data access request. At least one of the object information;
  • the method according to claim 1, wherein the specified information also includes environmental information of the access environment.
  • the business unit targeted by the data access request is determined as the target business unit, including:
  • the business unit targeted by the data access request is determined as the target business unit.
  • executing the data access policy includes:
  • the execution target includes at least one of the following: the data row of the original data corresponding to the access object, the data column of the original data corresponding to the access object, the access target The data unit of the original data corresponding to the object;
  • the data access policy is executed.
  • the policy element represents the fields used when determining the data access policy, and the specified information is composed of target fields; wherein, the configured in the zero-trust data access control system
  • the alternative strategies that match the specified information, as data access strategies include:
  • the alternative policy that matches the policy elements contained in each alternative policy with the target field in the specified information is used as the data access policy.
  • the alternative policies are arranged in order of priority from high to low; wherein, each of the alternative policies configured in the zero-trust data access control system is combined with all the alternative policies configured in the zero-trust data access control system.
  • the alternative strategies for matching specified information are described as data access strategies, including:
  • the first matching alternative policy determined will be used as the data access policy.
  • executing the data access policy includes any of the following:
  • this specification provides a data processing device based on a zero-trust data access control system for implementing the method in the first aspect.
  • this specification provides an electronic device, including:
  • a memory arranged to store computer-executable instructions which, when executed, cause the processor to perform the method of the first aspect.
  • the present specification provides a computer-readable storage medium that stores one or more programs that, when executed by an electronic device including a plurality of application programs, causes The electronic device performs the method in the first aspect.
  • Figure 1 is a flow chart of a data processing method based on a zero-trust data access control system in an embodiment of the present application
  • Figure 2 is a schematic diagram of an implementation scenario of a data processing method based on a zero-trust data access control system in an embodiment of the present application
  • Figure 3 is a schematic diagram of the architecture of a zero-trust data access control system in an embodiment of the present application
  • Figure 4 is a schematic diagram of the interface hierarchical relationship of the zero-trust data access control system in one embodiment of the present application
  • Figure 5 is a schematic diagram of the interaction between at least some terminals in the zero-trust data access control system according to an embodiment of the present application
  • Figure 6 is a schematic diagram of the data processing method based on the zero-trust data access control system in an embodiment of the present application executing data processing for different execution targets;
  • FIG. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • connection and “connection” mentioned in this application include direct and indirect connections (connections) unless otherwise specified.
  • a data processing method based on a zero-trust data access control system in this manual includes the following steps:
  • the zero-trust data access control system in this specification can be connected with several (one or more) applications.
  • This specification exemplifies one of the several applications (ie, the target application in this article) and the zero-trust data access control system. Taking the connection of the control system as an example, the methods in this manual will be explained.
  • the application in this manual contains several business units, and the business logic of different business units can be different.
  • the application may be an APP used by Bank A to provide services to customers.
  • the business units included in the application may be: deposit business, transfer business, inquiry business, etc.
  • the target business unit below is one of several business units. This specification takes the process of data processing for a target business unit based on the zero-trust data access control system as an example to illustrate the method in this specification.
  • the editing operation performed to obtain the alternative strategy is conditional editing.
  • the conditional edit can be a regular expression.
  • the policy elements represent the fields used when determining the data access policy.
  • the policy elements correspond one-to-one to the fields used when determining the data access policy.
  • the alternative strategy is obtained by conditionally editing (Condition) the strategy elements through regular expressions.
  • condition editing can realize the editing of rule conditions through regular expressions (for example: variable + relational operator + variable ⁇ or threshold>), where the variables can be configured as attributes of the policy elements corresponding to the specified information.
  • Relational operators are used to determine the logical relationship between variables (or between variables and thresholds) in policy conditions. Commonly used operators include greater than, equal to, less than, and not equal to, etc.
  • S104 Deliver the alternative policies corresponding to each business unit to the zero-trust data access control system.
  • alternative strategies in this specification are composed of strategy elements.
  • Alternative strategies are the strategies that can be adopted when dealing with the target business unit.
  • Alternative policies are pre-delivered to the zero-trust data access control system for selection in subsequent steps.
  • alternative strategies correspond to business units one-to-one.
  • An alternative strategy is a set of instructions that need to be executed when processing its corresponding business unit.
  • S106 In response to the data access request, determine the business unit targeted by the data access request as the target business unit.
  • the business logic for the target business unit is first called; based on the business logic, data access is called; in the data calling interface based on the called data access
  • the business unit targeted by the data access request is determined as the target business unit.
  • S108 Obtain the designated information corresponding to the target business unit from the context information of the target business unit.
  • the context information includes at least one of subject information of the access subject that triggered the data access request and object information of the access object targeted by the data access request.
  • the application scenarios involved in the data processing method based on the zero-trust data access control system in this specification are exemplarily shown in Figure 2.
  • the interaction process between the zero-trust data access control system and other terminals in this manual is schematically shown in Figure 3.
  • the target application processes data managed by the data source through a zero-trust data access control system.
  • the "left side” and “right side” described below take the orientation shown in Figure 2 as an example.
  • the access subject refers to the entity that actively accesses, and the subject can access the object.
  • Access subjects in this specification include, for example, people, systems, applications, etc.
  • person is for example: user subject (User ID entity of access control policy);
  • system is for example: account subject (Application Account entity of access control policy);
  • application is for example: application Subject (Application entity of the access control policy, including attributes such as the application to which it belongs, application category, etc.).
  • Different target applications have different roles in the data processing process, and the resources that different target applications can utilize in the data processing process (for example, such as PCs, mobile terminals, IOT devices, servers, etc.), in some cases can
  • different data processing environments for example, local/remote/cloud, headquarters/branch/partner, time, connection method, terminal environment and other factors
  • the subject information of the access subject in this manual can represent the identity, permissions and other attributes of the access subject.
  • the method in this manual can actually process data based on the permissions of the target business unit on the basis of zero trust on the left.
  • the access object in this specification is a passively accessed entity (that is, the accessed data), and the access of the object is subject to policy control.
  • Object information can characterize certain data of the access object.
  • the access object in this specification can be any of the following: API object (API interface entity called by the target application, including attributes such as associated data interface, interface encoding, data type, whether access control is enabled), application object (The accessed application entity, including the application to which it belongs, application category, and whether access control is enabled), column data object (the accessed column data entity can only be applied when the column policy is used.
  • row data object (the accessed row data entity, applicable in the row strategy and column strategy, the value of the row data object can refer to the actual value of the attribute of the accessed data), this process is exemplary As shown in Figure 6.
  • the specified information in this specification includes at least one of the subject information and the object information.
  • the access object can be a certain row of data, a certain column of data, or the original data in a certain data unit maintained by the data source.
  • the specified information is composed of the target field.
  • the process of generating alternative policies is the process of editing the policy elements according to business logic (execution conditions, execution operations, execution processes, etc.) into a collection of several policy rules (Policy Rules).
  • Policy Rules policy rules
  • a policy rule consists of at least several parts such as a condition (Rule Condition), an operation (Rule Action), and a priority (Rule Priority).
  • the process of generating alternative policies may include at least one of the following three aspects: condition editing (Condition), operation editing (Action), and priority editing.
  • the process of determining the specified information may be a process of field extraction from the information carried in the data access request according to an alternative policy, and the extracted fields are the target fields.
  • alternative policy 1 includes: field A, field B, and field C; the information carried in data access request 1 includes: field a, field b, and field d.
  • field a matches field A
  • field b matches field B.
  • field a and field b are the fields included in the specified information.
  • Field d is not a field included in the specified information.
  • S110 Use the alternative policy that matches the specified information among the alternative policies configured in the zero-trust data access control system as the data access policy.
  • the target field in the specified information obtained through the previous steps corresponds to the policy element (Policy Element) contained in the preset alternative policy in the trust data access control system.
  • Policy Element is the context that constitutes the policy, that is to say, The policy element may correspond to the target field in the subject information, the target field in the object information, and the target field in the environment information that will be mentioned in subsequent steps.
  • an alternative policy for each target field in the specified information, it can be determined whether an alternative policy contains policy elements that match the target field. If so, the alternative policy is a data access policy. . Following the foregoing embodiment of alternative policy 1 and data access request 1, since no field matching field C can be extracted from data access request 1, data access request 1 does not hit alternative policy 1.
  • the execution target for the data access policy is determined based on the zero-trust data access control system, where the execution target includes at least one of the following: the data row to which the access object belongs, The data column to which the access object belongs, and the data unit to which the access object belongs. Then, the data access policy is executed for the execution target.
  • the execution process of the data access policy may be to execute the operations indicated by the data access policy for the execution target.
  • Operation refers to the action performed after satisfying the above rule conditions (Rule Condition), that is, the method in which data output (data output rules) is performed.
  • Rule Condition the method in which data output (data output rules) is performed.
  • the operations represented by the data access policy include any of the following: desensitizing the original data corresponding to the access object; replacing the original data corresponding to the access object; retaining the original data corresponding to the access object.
  • Original data remove the original data corresponding to the access object.
  • the method in this manual achieves dynamic and refined access control of data by obtaining access control-related contextual information on the target application side, flexibly configuring data access policies based on business logic, and finally executing the constructed data access policy.
  • the method in this manual further moves the breadth of zero-trust access control from the target application side to the control side of data access (i.e., the "zero-trust data access control system" in this manual).
  • the zero-trust access control The granularity is further refined from the target application level to the business logic level, and by building and executing data access policies based on business logic Implement technology implementation to solve the problem that data access control cannot be extended under the current zero trust system, traditional processing products (for example, such as database firewalls, data desensitization, etc.) have insufficient granularity in access control, and hard-coded software cannot be configured dynamically and flexibly. And other issues.
  • the technical problems that can be solved by the methods in this manual include but are not limited to identity access control technology in related technologies.
  • This technology is limited to solving access control at the application level and cannot further achieve access control from the application to the data level; traditional IT From the perspective of data access control technologies, such as database firewalls, data desensitization, etc., these technologies cannot meet the dynamic and refined data access control requirements in complex business scenarios; related technologies use such complex data access control logic in the form of code Writing applications, this method will bring a lot of business coupling, causing many problems in application development, update and maintenance, etc.; related technologies cannot well meet the needs of dynamic and refined data access control.
  • Access environment refers to the environment involved in the process of accessing data.
  • the access environment may include at least one of the following: request environment (environment attributes of the client that initiates the access API request, including access time, HttpUri, HttpMethod, HttpHeaders, HttpParams, HttpBody and other attributes), client environment (environment attributes of the client that initiates the access, including Client device type, client operating system, client browser, client IP, device code and other attributes), server environment (environmental attributes of the accessed server, including server Host, service port and other attributes), and other environmental parameters.
  • request environment environment attributes of the client that initiates the access API request, including access time, HttpUri, HttpMethod, HttpHeaders, HttpParams, HttpBody and other attributes
  • client environment environment attributes of the client that initiates the access, including Client device type, client operating system, client browser, client IP,
  • the method in this specification can start from the aspect of targeting the target business unit to realize the management of the data processing process.
  • the method in this specification can also start from the aspect of targeting the access object to realize the management of the data processing process.
  • the subject information of the target application can be compared with the object information of the access object, and the data output rule (Action) can be executed according to the comparison result.
  • the subject information is compared with the information of each data managed by the data source, and the obtained comparison result indicates the data that the target business unit has permission to access among the data managed by the data source. ; Use the alternative policy that matches the comparison result among the preset access alternative policies in the zero-trust data access control system as the data access policy.
  • the subject information can also be compared with a set threshold (for example, the policy elements of a preset alternative policy in the trust data access control system), and the data output rules can be executed based on the comparison results.
  • a set threshold for example, the policy elements of a preset alternative policy in the trust data access control system
  • attributes of the access object are compared with attributes of the target application, and data output rules are executed based on the comparison results.
  • the subject information is compared with the object information, and the obtained comparison result indicates the access authority of the target business unit to the access object;
  • the preset in the trust data access control system is Access the alternative strategy that matches the comparison result as the data access strategy.
  • the attributes of the access object can also be compared with a set threshold, and the data output rules can be executed based on the comparison results.
  • the process of determining the data access policy in this specification may also include priority editing. Now we will explain the priority editing.
  • different alternative strategies have different priorities, and the alternative strategies are arranged in order from high to low priority.
  • determining the data access policy from the alternative policies compare the alternative policies and the specified information in order from high to low; determine whether the alternative policies match the specified information; The first matching alternative policy is used as the data access policy.
  • Other alternative strategies will not be implemented in subsequent steps.
  • the priority in this specification may be negatively related to the amount of resources consumed by this data access process. The more resources consumed, the lower the priority.
  • the resources consumed can be time resources, interface resources, predicted computing power provided by the zero-trust data access control system during this data processing, etc.
  • the zero-trust data access control system can determine the global policy that is preset in the trust data access control system (the global policy scope can control all policies).
  • the global policy that matches the specified information is used as the global target policy; from the application policies included in the global target policy (the application policy scope can control all policies of an application), the application policy that matches the specified information is determined, As the application target policy; from the interface group policy included in the application target policy (multiple interfaces in the application can be divided into different interface groups, each interface group policy scope can control the policies of all interfaces in the group), determine Output the interface group policy that matches the specified information (each interface group consists of multiple interfaces, and the interface group policy scope can control all interface policies under the interface group) as the interface group target policy; set the interface group target Among the interface policies included in the policy (each interface policy is composed of multiple interface branch policies, and the interface policy scope can control all interface branch policies under the interface), the interface policy that matches the specified information is determined as the interface target Strategy.
  • the interface branch policy determines the interface branch policy that matches the specified information.
  • the interface branch policy (whereas the scope of the interface branch policy is limited to the policy that controls the interface branch), the interface branch policy executes on the branch data Access control, branch data is one of the smallest units that can execute access control data), as the target policy.
  • an inverted index can be established for the candidate strategies according to the hierarchical attributes of each candidate strategy, and then the process of matching the strategies can be a search process based on the inverted index.
  • the group policy will take effect on the interfaces with access control enabled under the group to which it belongs.
  • the group policy can be a row policy or a column policy.
  • the row policy is suitable for access control of row data for the interface of the group
  • the column policy is suitable for the group.
  • the interface controls access to column data. For example, displaying data by each branch of an enterprise belongs to the control of row data, and the group policy created should be a row policy attribute.
  • the group policy acts on the data branches under the interfaces of this group that have access control enabled.
  • Group policy performs access control on rows that return data from all interfaces in the group
  • group policy on column attributes performs access control on columns that return data on all interfaces in the group.
  • the interface policy performs access control on the data returned under the interface.
  • the interface policy can be a row policy or a column policy. The interface policy takes effect on all branches where access control is enabled on the interface and there is no policy on the branch or all branch policies are disabled. .
  • the method in this manual formulates different data access strategies for different applications, different interfaces, and different interface branches, and limits these strategies to different usage scopes (scopes) for management.
  • the method in this manual formulates a branch policy for branch data, which can achieve precise data access control.
  • the branch policy will not have any impact on other branches.
  • the branch policy only takes effect on branches with access control enabled, and the branch policy has the smallest scope of influence. . .
  • Different policy management scopes can be set through hierarchical management modes such as global policy scope, application policy scope, interface group policy scope, interface policy scope, and interface branch policy scope to achieve flexible and precise data access control, such as As shown in Figure 4, Figure 4 shows the grouping strategy in the image range.
  • the architecture of the zero-trust data access control system is shown in Figure 5.
  • the zero-trust data access control system includes DAC (Data Access Control) management console, DAC server and DAC controller.
  • the DAC management console is an operation control component used to edit, manage, and issue data access control policies based on the administrator's instructions, and to view and analyze various logs.
  • the administrator uses the DAC management console to complete the policy configuration management function according to the respective business logic of each business unit included in the different applications and the corresponding data access control requirements.
  • the alternative policies can be transferred to the DAC server through the DAC server. Synchronize to multiple DAC controllers to complete policy distribution.
  • the DAC server and DAC controller When viewing and analyzing logs, the DAC server and DAC controller will generate various logs during operation, such as system logs, operation logs, data access logs, policy process logs, etc. These logs will be stored on the DAC server or a separate storage device. Operation administrators can view various logs through the DAC management console and discover various abnormal situations through log analysis, such as system abnormalities, operation Exceptions, data access exceptions, policy process exceptions, etc., thereby helping administrators find and solve problems.
  • DAC Server is a component used to store data access control policies and various log information. It is also responsible for synchronizing policies to the DAC console, collecting DAC controller logs, and synchronizing data with third-party systems.
  • the alternative policies configured by the administrator need to be stored in the DAC server or a separate storage device through the DAC server for further policy management or policy synchronization; at the same time, the data generated by each part of the DAC system Various types of logs also need to be stored in the DAC server or a separate storage device for further viewing or analysis.
  • Policy synchronization refers to synchronizing the alternative policies configured by the administrator from the DAC server to the designated DAC controller so that the DAC controller can perform data access control based on the data access policy.
  • it can be implemented by pushing the policy to the DAC controller through the DAC server, or pulling the policy from the DAC server through the DAC controller.
  • Log synchronization refers to synchronizing various logs generated by the DAC controller to the DAC server and storing them in the DAC server or a separate storage device for administrators to view and analyze.
  • log synchronization it can be achieved by pulling the logs from the DAC server to the DAC controller, or by uploading or pushing the logs to the DAC server or a separate storage device through the DAC controller.
  • a third party in order to build policy elements (policy context), it is usually necessary to obtain relevant data from a third party in advance, such as obtaining user identities and permissions from AD (domain management system), IAM (identity access management system), etc.
  • Information such as data attributes and other information are obtained from databases and big data platforms, and terminal and server environment information are obtained from terminal access software and zero-trust SDP systems. Therefore, relevant data needs to be obtained from a third party.
  • third-party data synchronization can be obtained from the third party in real-time during use, or regularly obtained from the third party in advance through non-real-time, stored in a local DAC server or a separate storage device, and then obtained locally when used.
  • DAC Controller is a component that specifically implements data access control policies. This component is deployed in the form of SDK and runs in the application. It can execute policies and log synchronization by cooperating with the DAC server.
  • the DAC controller can also be used to execute the data processing method based on the zero-trust data access control system in this specification.
  • the application can call the DAC policy execution engine related interface in the DAC controller and input the original business data and related context information.
  • the DAC policy execution engine first based on the relevant context information Construct the policy elements, then perform policy matching through the policy elements, and finally perform corresponding rule operations on the original business data according to the matched policy rules to complete access control of the original business data, and finally return the processed business data to the application;
  • the policy synchronized to the DAC controller changes, the DAC policy execution engine will perform access control based on the latest policy, so administrators can dynamically adjust the policy based on business needs and take effect immediately.
  • the application calls the interface of the DAC policy execution engine to mainly input two parts of data: 1.
  • Original business data that is, the data object for data access control operations; 2.
  • User information, environment information, and business operations Information and other contextual information facilitate the construction of policy elements and execution of policy matching.
  • the DAC policy execution engine After the DAC policy execution engine is called by the target application, the corresponding execution process is as follows: 1. Construct data access control policy elements based on the input user information, environment information, business operation information and other contextual information; 2. Match the data access control policy based on the policy elements ; 3. If the row policy is matched, the row-level data access control policy is executed; 4. If the column policy is matched, the column-level data access control policy is executed; 5. If the unit policy is matched, the unit-level data access control is executed Strategy; after the strategy execution is completed, the processed business data is returned to the target application.
  • the method in this manual adheres to the zero trust concepts of never trust, minimum permissions, and continuous verification, and further expands zero trust's access control capabilities on the data side.
  • it refines the granularity of zero trust's data access control, and uses The policy editing and policy management of business logic realizes dynamic and refined data access control, solving the key issues of technology implementation.
  • the complete zero-trust data access control system architecture realizes the complete process from policy editing, policy distribution to policy execution.
  • the complete system composition allows users to complete policy adjustments through policy editing in a timely manner according to changes in business logic, and issue and execute them to take effect immediately, which avoids the inability of traditional database firewalls, database desensitization and other products to provide refined access based on business logic.
  • the control problem also solves flexibility problems such as business coupling caused by traditional hard coding and difficulties in application development, update and maintenance, and truly realizes dynamic and refined data access control based on zero trust.
  • Geneating alternative strategies in this specification includes the process of creating alternative strategies and/or modifying alternative strategies.
  • the functional location is first determined, specifically, data access control platform->application management->application operation column.
  • API access Ask Control->Application Interface Policy Configuration->Interface Management->Operation column of the interface under the interface group->Interface Management->Policy Management.
  • select the alternative strategy type The options include column strategy and row strategy. In most cases, column strategy is selected. Among them, the column strategy is used to control the desensitization or removal of sensitive fields in the returned data, and the row strategy is used to control the filtering of the data set results in the returned data, so that only part of the data is returned.
  • ABAC rule edge is the carrier of the ABAC rule, set the execution priority for the policy through the rule edge, and configure the ABAC condition) editing window.
  • the format of policy conditions variables, operators, variables (or constants), where the variables can be configured as access subjects, access objects, and access environment information; if the policy conditions are set to judge attributes and thresholds, it means that the attributes are specified values subject for access control.
  • the saving operation for the edited result it is determined that the condition is set successfully.
  • the filtering requirement is: all data with a level > 2 need to be desensitized. It is expected that the execution results phone, idNumber, debitCardNumber, password, debitCardBalance will be desensitized, and other data will be retained.
  • configure the policy For example, configure the first policy condition, and then configure the first data desensitization end node. Then, configure the second policy condition, and then configure the second data desensitization end node.
  • the specific operations are as follows: select the first policy condition, configure the execution priority of the condition, trigger the editing of ABAC conditions, and set the ABAB rule editing window.
  • the data classification of the data object listed in the access object is greater than a constant 2, that is, it can Sets data processing for grading specified data.
  • the specific operations are as follows: determine the second data desensitization end node, trigger the edit output configuration, and execute the result code, then select the data to be desensitized.
  • the desensitization effect is: data with a data classification greater than 2 are desensitized and displayed, and data with a data classification less than or equal to 2 are output as original data.
  • the filtering requirement is: when the role of the general manager accesses the data, the original data is output, and when other employees access the data, the bank card number (debitCardNumber) is desensitized.
  • the visitor's application account is passed into the setCtxAppAccount() object, and the system will determine the visitor's identity based on the passed in value.
  • the access role is employee
  • the data is desensitized.
  • the obtained desensitization effect is: when the general manager, Manager Wang, accesses employee information, the original data is returned.
  • employee Zhang Xun accessed the information, the bank card number in the information was desensitized.
  • the filtering requirement is: when the data in the data information with a bank card balance greater than 1,000 is accessed, the phone number is dynamically desensitized, and if the bank card balance is not greater than 1,000, the original data is retained and output.
  • the process of policy configuration is: first configure the policy conditions. For example, if the bank card balance is greater than 1000, the debitCardBalance of the row data object in the access object will be greater than 1000 in the ABAC policy editor; at the same time, use AND to set another condition, and configure the condition to be that the attribute code is equal to the phone number phone. Then, configure the data desensitization end node. For example, if the phone number corresponding to a value with a bank card balance greater than 1,000 is set, the output data of the node will be desensitized. After that, configure the policy conditions. For example, except for data with bank card balance greater than 1000, other data are less than or equal to 1000. There is no need to set ABAC judgment. Use judgment rules to judge other amounts.
  • the data desensitization end node For example, for phone numbers corresponding to values less than or equal to 1000, set the output of the node to retain the original data.
  • the obtained desensitization effect is: the phone number corresponding to the debit card balance greater than 1000 is desensitized and displayed.
  • the filtering requirement is: dynamically desensitize the account and password in the data.
  • the expected execution result is that the password field is desensitized and other information retains the original data.
  • the process of policy configuration is: first configure the policy conditions. For example, if the data is a bank card password field, in the ABAC policy editor, set the attribute code of the data object listed in the access object to password to set the data processing for the specified field. Then, configure the data desensitization end node. For example, for data in the bank card password field, the data is desensitized. After that, configure the policy conditions. For example, except for the bank card password field, other data are non-bank card passwords. There is no need to set ABAC judgment rules to judge other amounts. Then, configure the data desensitization end node. For example, for data in non-bank card password fields, retain the original data.
  • the obtained desensitization effect is: the field whose attribute code is password is dynamically desensitized.
  • the filtering requirement is: the system recognizes the access request initiated by the client with IP address 192.168.53.2, and directly filters the data without returning any data.
  • the process of policy configuration is: first configure the policy conditions. For example, if the client IP that initiates the data access request is 192.168.53.2, and the client IP of the client environment in the access environment is set to 192.168.53.2 in the ABAC editor, it can be determined that the access client IP is 192.168.53.2. After that, configure the data desensitization end node. For example, the client IP that initiated the data access request is 192.168.53.2, and the data is removed. Then, configure the policy conditions. For example, except that the client IP is 192.168.53.2, all other data are not from this client. There is no need to set ABAC judgment rules to judge other amounts. After that, configure the data desensitization end node. For example, for other client IPs, keep the original data.
  • embodiments of this specification also provide a data processing device based on a zero-trust data access control system corresponding to part of the process shown in Figure 1.
  • a data processing device based on a zero-trust data access control system in this specification may include one or more of the following modules:
  • Business unit determination module the quota is: determine each business unit included in the target application.
  • the alternative strategy generation module is configured to: for each business unit, according to the business needs of the business unit, the policy elements are generated according to the business logic and the alternative strategy corresponding to the business unit; wherein, The alternative strategies are strategies that can be executed when processing their corresponding business units.
  • the alternative policy delivery module is configured to deliver alternative policies corresponding to each business unit to the zero-trust data access control system.
  • the target business unit determination module in response to the data access request, determine the business unit targeted by the data access request as the target business unit.
  • the designated information determination module the quota is: obtain the designated information corresponding to the target business unit from the context information of the target business unit; wherein the context information includes the subject information of the access subject that triggered the data access request, the At least one of the object information of the access object targeted by the data access request.
  • the quota is: among the alternative policies configured in the zero-trust data access control system, the alternative policy that matches the specified information is used as the data access policy.
  • Execution module the quota is: execute the data access policy.
  • the specified information also includes environmental information of the access environment.
  • the specific quota of the target business unit determination module is: calling business logic for the target business unit; calling data access based on the business logic; accessing data based on the calling data
  • the business unit targeted by the data access request is determined as the target business unit.
  • the specific quota of the execution module is: determining the execution target targeted by the data access policy; wherein the execution target includes at least one of the following: data of the original data corresponding to the access object rows, data columns of original data corresponding to the access object, and data units of original data corresponding to the access object; and execute the data access policy for the execution target.
  • the policy element represents the fields used when determining the data access policy, and the specified information is composed of target fields.
  • the specific quota of the data access policy determination module is: use the alternative policy that matches the policy elements contained in each alternative policy with the target field in the specified information as data Access policy.
  • the specific quota of the data access policy determination module is: in the order from high to low, compare the alternative policies and the specified information to see if they match; A matching alternative policy as the data access policy.
  • the specific quota of the data access policy determination module is: desensitizing the original data corresponding to the access object.
  • the original data corresponding to the access object is replaced.
  • the original data corresponding to the access object is retained.
  • the original data corresponding to the access object is removed.
  • Figure 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application. Please refer to Figure 5.
  • the electronic device includes a processor and optionally an internal bus, a network interface, and a memory.
  • the memory may include memory, such as high-speed random access memory (Random-Access Memory, RAM), or may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
  • RAM random access memory
  • non-volatile memory such as at least one disk memory.
  • the electronic equipment may also include other hardware required by the business.
  • the processor, network interface and memory can be connected to each other through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect, a peripheral component interconnect standard) bus or an EISA (Extended Industry Standard Architecture, extended industrial standard architecture) bus, etc.
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one bidirectional arrow is used in Figure 5, but it does not mean that there is only one bus or one type of bus.
  • Memory used to store programs.
  • a program may include program code including computer operating instructions.
  • Memory may include internal memory and non-volatile memory and provides instructions and data to the processor.
  • the processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a data processing method based on the zero-trust data access control system at the logical level.
  • the processor executes the program stored in the memory, and is specifically used to execute any of the aforementioned data processing methods based on the zero-trust data access control system.
  • the above-mentioned data processing method based on the zero-trust data access control system disclosed in the embodiment shown in Figure 2 of this application can be applied to a processor (ie, the deletion control module in this specification), or implemented by the processor.
  • the processor may be an integrated circuit chip that has signal processing capabilities.
  • each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the processor.
  • the above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processor, DSP), dedicated integrated processor circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the electronic device can also execute a data processing method based on the zero-trust data access control system in Figure 2, and implement the functions of the embodiment shown in Figure 2.
  • the embodiments of this application will not be described in detail here.
  • Embodiments of the present application also provide a computer-readable storage medium that stores one or more programs.
  • the one or more programs include instructions, which when executed by an electronic device including multiple application programs When, the electronic device can be made to execute a method of executing a data processing method based on the zero-trust data access control system in the embodiment shown in Figure 2, and is specifically used to execute any of the aforementioned methods based on the zero-trust data access control system. Data processing methods.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions means to implement a process or multiple flows in a flowchart Functions specified in a block or blocks of a process and/or block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • magnetic Cassettes tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • embodiments of the present application may be provided as methods, systems or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种基于零信任数据访问控制系统的数据处理方法，通过在应用一端获取访问控制相关的上下文信息，灵活配置基于业务逻辑的数据访问策略，最后执行所构建的数据访问策略来实现对于数据的动态精细化访问控制。本说明书中的方法将零信任访问控制的广度从应用一端进一步后移至数据访问的控制端，同时，将零信任访问控制的粒度从应用层面进一步细化至业务逻辑层面，并通过构建和执行基于业务逻辑的数据访问策略来实现技术落地。

Description

基于零信任数据访问控制系统的数据处理方法
相关申请的交叉引用
本申请要求享有于2022年08月05日提交的名称为“基于零信任数据访问控制系统的数据处理方法”的中国专利申请2022109367330的优先权，上述申请的全部内容通过引用并入本文中。
技术领域
本申请属于数据处理研究领域，特别涉及一种基于零信任数据访问控制系统的数据处理方法。
背景技术
企业的数据资产与其业务之间存在着千丝万缕的联系。在企业的数据安全治理过程中，既要考虑业务可用性，同时还要兼顾数据的合法、合规使用问题，该矛盾在数据访问控制领域中尤其是隐私数据保护场景中尤为突出，具体体现在如何解决不同访问主体(人、系统、应用等)，基于不同角色和权限，利用不同的资源(PC、服务器、移动终端、IOT设备等)，根据不同业务场景，在最小化权限之下，合法、合规地访问各类数据(访问客体)，以满足各类法律法规及行业约束的要求。
可见，如何在满足企业的数据需求的同时，提高数据管理过程的安全性，成为亟待解决的问题。
发明内容
为了解决所述现有技术的不足，本申请提供了一种基于零信任数据访问控制系统的数据处理方法，通过在应用(Application)一端获取访问控制相关的上下文信息，灵活配置基于业务逻辑的数据访问策略，最后执行所构建的数据访问策略来实现对于数据的动态精细化访问控制。本说明书中的方法将零信任访问控制的广度从应用一端进一步后移至数据访问的控制端(即，本说明书中的“基于零信任数据访问控制系统”)，同时，将零信任访问控制的粒度从应用层面进一步细化至业务逻辑层面，并通过构建和执行基于业务逻辑的数据访问策略来实现技术落地，解决当前零信任体系下数据访问控制无法延伸，传统 处理产品访问控制精细化粒度不够，以及软件硬编码无法动态灵活配置等问题。
本申请所要达到的技术效果通过以下方案实现：
第一方面，本说明书提供一种基于零信任数据访问控制系统的数据处理方法，所述方法包括：
确定目标应用包含的各个业务单元；
针对每一个业务单元，根据所述业务单元的业务需求，将策略要素按照业务逻辑生成所述业务单元对应的备选策略；其中，所述备选策略是处理其对应的业务单元时，可供执行的策略；
将所述各个业务单元各自对应的备选策略，下发至所述基于零信任数据访问控制系统；
响应于数据访问请求，将所述数据访问请求所针对的业务单元确定为目标业务单元；
从所述目标业务单元的上下文信息，获取所述目标业务单元对应的指定信息；其中，所述上下文信息包括触发所述数据访问请求的访问主体的主体信息、所述数据访问请求针对的访问客体的客体信息中的至少一个；
将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略；
执行所述数据访问策略。
在本说明书一个可选的实施例中，如权利要求1所述的方法，其特征在于，所述指定信息还包括访问环境的环境信息。
在本说明书一个可选的实施例中，将所述数据访问请求所针对的业务单元确定为目标业务单元，包括：
调用针对所述目标业务单元的业务逻辑；
基于所述业务逻辑，调用数据访问；
在基于所述调用数据访问的数据调用接口返回原始数据时，将所述数据访问请求所针对的业务单元确定为目标业务单元。
在本说明书一个可选的实施例中，执行所述数据访问策略，包括：
确定所述数据访问策略针对的执行目标；其中，所述执行目标包括以下至少一种：所述访问客体对应的原始数据的数据行、所述访问客体对应的原始数据的数据列、所述访问客体对应的原始数据的数据单元；
针对所述执行目标，执行所述数据访问策略。
在本说明书一个可选的实施例中，所述策略要素表示出确定数据访问策略时所采用的字段，所述指定信息由目标字段构成；其中，将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略，包括：
将所述各个备选策略中，包含的策略要素与所述指定信息中的目标字段匹配的备选策略，作为数据访问策略。
在本说明书一个可选的实施例中，所述备选策略按照优先级由高到低的次序排列；其中，将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略，包括：
按照所述由高到低的次序，依次对备选策略和指定信息是否匹配进行比对；
将确定出的第一个匹配的备选策略，作为数据访问策略。
在本说明书一个可选的实施例中，执行所述数据访问策略，包括以下任意一种：
对所述访问客体对应的原始数据进行脱敏；
对所述访问客体对应的原始数据进行替换；
保留所述访问客体对应的原始数据；
移除所述访问客体对应的原始数据。
第二方面，本说明书提供一种基于零信任数据访问控制系统的数据处理装置，用于实现第一方面中的方法。
第三方面，本说明书提供一种电子设备，包括：
处理器；以及
被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理器执行第一方面中的方法。
第四方面，本说明书提供一种计算机可读存储介质，所述计算机可读存储介质存储一个或多个程序，所述一个或多个程序当被包括多个应用程序的电子设备执行时，使得所述电子设备执行第一方面中的方法。
附图说明
为了更清楚地说明本申请实施例或现有的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付 出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请一实施例中一种基于零信任数据访问控制系统的数据处理方法的流程图；
图2为本申请一实施例中的基于零信任数据访问控制系统的数据处理方法的实施场景示意图；
图3为本申请一实施例中的基于零信任数据访问控制系统架构示意图；
图4为本申请一实施例中基于零信任数据访问控制系统接口层级关系示意图；
图5为本申请一实施例中基于零信任数据访问控制系统包含至少部分端之间的交互示意图；
图6为本申请一实施例中的基于零信任数据访问控制系统的数据处理方法针对不同的执行目标执行数据处理的示意图；
图7为本申请一实施例中一个实施例电子设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合具体实施例及相应的附图对本申请的技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
下面通过具体实施方式结合附图对本发明作进一步详细说明。其中不同实施方式中类似元件采用了相关联的类似的元件标号。在以下的实施方式中，很多细节描述是为了使得本申请能被更好的理解。然而，本领域技术人员可以毫不费力的认识到，其中部分特征在不同情况下是可以省略的，或者可以由其它元件、材料、方法所替代。在某些情况下，本申请相关的一些操作并没有在说明书中显示或者描述，这是为了避免本申请的核心部分被过多的描述所淹没，而对于本领域技术人员而言，详细描述这些相关操作并不是必要的，他们根据说明书中的描述以及本领域的一般技术知识即可完整了解相关操作。
另外，说明书中所描述的特点、操作或者特征可以以任意适当的方式结合形成各种实施方式。同时，方法描述中的各步骤或者动作也可以按照本领域技术人员所能显而易见的方式进行顺序调换或调整。因此，说明书和附图中的各 种顺序只是为了清楚描述某一个实施例，并不意味着是必须的顺序，除非另有说明其中某个顺序是必须遵循的。
本文中为部件所编序号本身，例如“第一”、“第二”等，仅用于区分所描述的对象，不具有任何顺序或技术含义。而本申请所说“连接”、“联接”，如无特别说明，均包括直接和间接连接(联接)。
本说明书提供一种基于零信任数据访问控制系统的数据处理方法，以解决相关技术中存在的问题。下面结合附图，详细说明本申请的各种非限制性实施方式。本说明书中的一种基于零信任数据访问控制系统的数据处理方法，包括以下步骤：
S100：确定目标应用包含的各个业务单元。
本说明书中的基于零信任数据访问控制系统可以与若干(一个或一个以上)应用对接，本说明书示例性地以若干个应用中之一(即，本文中的目标应用)与基于零信任数据访问控制系统的对接为例，对本说明书中的方法进行说明。
本说明书中的应用包含若干个业务单元，不同的业务单元的业务逻辑可以不同。示例性地，在金融服务领域，应用可以是银行A为客户提供服务的APP，该应用包含的业务单元可以是：存款业务、转账业务、查询业务等。
下文中的目标业务单元是若干个业务单元中的一个。本说明书示例性地以基于零信任数据访问控制系统针对目标业务单元对数据处理的过程为例，对本说明书中的方法进行说明。
S102：针对每一个业务单元，根据所述业务单元的业务需求，将策略要素按照业务逻辑生成包含若干个策略规则的策略，作为所述业务单元对应的备选策略；其中，所述备选策略是处理其对应的业务单元时，可供执行的策略。
在本说明书一个可选的实施例中，为得到备选策略所执行的编辑操作是条件编辑。该条件编辑可以是正则表达。
可选的，策略要素表示出确定数据访问策略时所采用的字段，可选地，策略要素与确定数据访问策略时所采用的字段一一对应。备选策略是通过正则表达式对所述策略要素进行条件编辑(Condition)得到的。其中，条件编辑可通过正则表达式(例如：变量+关系运算符+变量<或阈值>)实现规则条件的编辑，其中变量可配置为指定信息对应的策略要素的属性。关系运算符，用于判断策略条件中变量与变量之间(或变量与阈值之间)的逻辑关系，常用的运算符有大于、等于、小于和不等于，等等。
S104：将所述各个业务单元各自对应的备选策略，下发至所述基于零信任数据访问控制系统。
本说明书中的备选策略是由策略要素构成的。备选策略是处理目标业务单元时可供采用的策略。备选策略预先的被下发至基于零信任数据访问控制系统，以供后续步骤进行选取。可选地，备选策略与业务单元一一对应。备选策略是在对其对应的业务单元进行处理时需要执行的一系列指令的集合。
S106：响应于数据访问请求，将所述数据访问请求所针对的业务单元确定为目标业务单元。
在本说明书一个可选的实施例中，如图3所示，首先调用针对所述目标业务单元的业务逻辑；基于所述业务逻辑，调用数据访问；在基于所述调用数据访问的数据调用接口返回原始数据时，将所述数据访问请求所针对的业务单元确定为目标业务单元。
S108：从所述目标业务单元的上下文信息，获取所述目标业务单元对应的指定信息。
其中，所述上下文信息包括触发所述数据访问请求的访问主体的主体信息、所述数据访问请求针对的访问客体的客体信息中的至少一个。
本说明书中的基于零信任数据访问控制系统的数据处理方法涉及的应用场景示例性地如图2所示。本说明书中的基于零信任数据访问控制系统与其他端之间的交互过程示意性地如图3所示。目标应用通过基于零信任数据访问控制系统，对数据源管理的数据进行处理。下文中所述的“左侧”、“右侧”，均以图2中所示的方位为例。
访问主体是指主动访问的实体，主体可以访问客体。本说明书中的访问主体示例性地如人、系统、应用等。其中，“人”例如：用户主体(访问控制策略的用户身份(User ID)实体)；“系统”例如：账号主体(访问控制策略的应用账号(Application Account)实体)；“应用”例如：应用主体(访问控制策略的应用(Application)实体，包括所属应用，应用类别等属性)。
不同的目标应用的数据处理过程中所处的角色不同，则不同的目标应用在数据处理过程可以利用的资源(示例性地，如PC、移动终端、IOT设备、服务器等)，在某些可选的场景中，不同的数据处理环境(示例性地，本地/远程/云端、总部/分支机构/合作伙伴、时间、连接方式、终端环境等因素)，对目标应用访问权限的要求也有所不同。
本说明书中的访问主体的主体信息能够表示出访问主体的标识、权限等属性，也就是说，本说明书中的方法能够在左侧零信任的基础上，实际基于目标业务单元权限的数据处理。
本说明书中的访问客体是一个被动访问的实体(即被访问的数据)，客体的访问要受策略控制。客体信息能够对访问客体的某些数据进行表征。示例性地，本说明书中的访问客体可以是以下任一种：API客体(被目标应用调用的API接口实体，包括关联数据接口，接口编码，数据类型，是否启用访问控制等属性)，应用客体(被访问的应用实体，包括所属应用，应用类别，是否启用访问控制)，列数据客体(被访问的列数据实体，只能在列策略时适用。包括属性代码，属性代码路径，数据分类，数据分级，值等属性)，行数据客体(被访问的行数据实体，在行策略和列策略时适用，行数据客体的值可指被访问数据的属性的实际值)，该过程示例性地如图6所示。
本说明书中的指定信息包括所述主体信息、客体信息中的至少一个。可选地，访问客体可以是数据源维护的某一行数据、某一列数据或者某一个数据单元中的原始数据。
在本说明书一个可选的实施例中，指定信息由所述目标字段构成。生成备选策略的过程，即为把策略要素依照业务逻辑(执行条件、执行操作、执行流程等)编辑而成的若干条策略规则(Policy Rule)的集合的过程。在本说明书一个可选的实施例中，一条策略规则至少由条件(Rule Condition)、操作(Rule Action)和优先级(Rule Priority)等几个部分构成。
在本说明书一个可选地实施例中，生成备选策略的过程可以包括以下三个方面中的至少一个：条件编辑(Condition)、操作编辑(Action)、优先级编辑。
在本说明书一个可选的实施例中，确定指定信息的过程可以是根据备选策略对数据访问请求中携带的信息进行字段提取的过程，提取到的字段即为目标字段。例如，备选策略1包含：字段A、字段B、和字段C；数据访问请求1中携带的信息包含：字段a、字段b、和字段d。其中，字段a与字段A匹配，字段b与字段B匹配。则其中字段a、字段b是指定信息中包含的字段。字段d不是指定信息中包含的字段。
S110：将所述零信任数据访问控制系统中配置的各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略。
可见，通过本说明书中的方法，基于不同的业务逻辑，实现动态精细化的数据访问控制，并持续验证，以满足各类法律、法规及行业约束的要求，即右侧零信任——零信任的最后一公里。
通过前述步骤得到的指定信息中的目标字段与信任数据访问控制系统中预先设定的备选策略包含的策略要素(Policy Element)对应，策略要素是构成策略的上下文(Context)，也就是说，策略要素可以对应于主体信息中的目标字段、客体信息中的目标字段、以及后续步骤中将要提及的环境信息中的目标字段。
在本说明书一个可选的实施例中，可以针对指定信息中的每个目标字段，确定一备选策略是否包含与该目标字段匹配的策略要素，若是，则该备选策略是对数据访问策略。继前述备选策略1和数据访问请求1的实施例，由于数据访问请求1中提取不到与字段C匹配的字段，则数据访问请求1没有命中备选策略1。
S112：执行所述数据访问策略。
在本说明书一个可选的实施例中，基于零信任数据访问控制系统确定所述数据访问策略针对的执行目标，其中，所述执行目标包括以下至少一种：所述访问客体所属的数据行、所述访问客体所属的数据列、所述访问客体所属的数据单元。然后，针对所述执行目标，执行所述数据访问策略。
可选地，对数据访问策略的执行过程可以是针对所述执行目标执行所述数据访问策略表示出的操作。
操作(Rule Action)是指满足上述规则条件(Rule Condition)后所执行的动作，即按照什么方式执行数据输出(数据输出规则)。在本说明书一个可选的实施例中，数据访问策略表示出的操作包括以下任意一种：对访问客体对应的原始数据进行脱敏；对访问客体对应的原始数据进行替换；保留访问客体对应的原始数据；移除访问客体对应的原始数据。
本说明书中的方法通过在目标应用一端获取访问控制相关的上下文信息，灵活配置基于业务逻辑的数据访问策略，最后执行所构建的数据访问策略来实现对于数据的动态精细化访问控制。本说明书中的方法将零信任访问控制的广度从目标应用一端进一步后移至数据访问的控制端(即，本说明书中的“基于零信任数据访问控制系统”)，同时，将零信任访问控制的粒度从目标应用层面进一步细化至业务逻辑层面，并通过构建和执行基于业务逻辑的数据访问策 略来实现技术落地，解决当前零信任体系下数据访问控制无法延伸，传统处理产品(示例性地，如数据库防火墙、数据脱敏等)访问控制精细化粒度不够，以及软件硬编码无法动态灵活配置等问题。
本说明书中的方法能解决的技术问题包括但不限于相关技术中身份访问控制技术，该技术仅限于解决对应用层面的访问控制，而无法进一步做到从应用到数据层面的访问控制；传统IT视角下的数据访问控制技术，如数据库防火墙、数据脱敏等，这些技术无法满足复杂业务场景下动态精细化的数据访问控制要求；相关技术通过将此类复杂的数据访问控制逻辑以代码的方式写入应用程序，这种方式会带来大量的业务耦合，造成应用程序开发、更新以及维护等方面的诸多问题，等等；相关技术无法很好地满足动态精细化数据访问控制的需求。
为进一步提高数据访问策略的全面性，本说明书中的指定信息还可以包括访问环境的访问环境信息。访问环境是指访问数据过程中所涉及到的环境。访问环境可以包括以下至少一种：请求环境(发起访问API请求的环境属性，包括访问时间，HttpUri，HttpMethod，HttpHeaders，HttpParams，HttpBody等属性)，客户端环境(发起访问的客户端的环境属性，包括客户端设备类型，客户端操作系统，客户端浏览器，客户端IP，设备码等属性)，服务器环境(访问的服务器的环境属性，包括服务器Host，服务端口等属性)，其他环境参数。
在本说明书一个可选的实施例中，策略规则的上下文的说明如以下表1所示：
表1


本说明书中的方法可以从针对目标业务单元的方面着手，实现对数据处理过程的管理，此外，本说明书中的方法还可以从针对访问客体的方面着手，实现对数据处理过程的管理。现就前述两个方面分别进行说明。
(1)针对目标业务单元的访问控制。
在一个可选的实施例中，可以将目标应用的主体信息与访问客体的客体信息进行对比，根据对比结果执行数据输出规则(Action)。
可选地，将所述主体信息与所述数据源管理的各数据的信息进行比对，得到的对比结果表示出所述数据源管理的各数据中，所述目标业务单元有权限访问的数据；将所述零信任数据访问控制系统中预先设定的访问备选策略中与所述比对结果匹配的备选策略，作为数据访问策略。
在另一个可选的实施例中，也可将主体信息与设定的阈值(例如，信任数据访问控制系统中预先设定的备选策略的策略要素)进行对比，根据对比结果执行数据输出规则。
(2)针对访问客体的访问控制。
在一个可选的实施例中，将访问客体的属性与目标应用的属性进行对比，根据对比结果执行数据输出规则。
可选地，将所述主体信息与所述客体信息进行对比，得到的对比结果表示出所述目标业务单元对所述访问客体的访问权限；将所述信任数据访问控制系统中预先设定的访问备选策略中与所述比对结果匹配的备选策略，作为数据访问策略。
在另一个可选的实施例中，也可将访问客体的属性与设定的阈值进行对比，根据对比结果执行数据输出规则。
由前述内容可知，在可选的实施例中，本说明书中的确定数据访问策略的过程还可以包括优先级编辑。现针对优先级编辑进行说明。
在本说明书一个可选的实施例中，不同备选策略的优先级不同，备选策略按照优先级由高到低的次序排列。在从备选策略中确定数据访问策略时，按照所述由高到低的次序，依次对备选策略和指定信息是否匹配进行比对；将确定 出的第一个匹配的备选策略，作为数据访问策略。而其他备选策略则在后续步骤中不予执行。
本说明书中的优先级可以与本次数据访问过程消耗的资源的量负相关。消耗的资源越多，则优先级越低。消耗的资源可以是时间资源、接口资源、预测到的本次数据处理过程中基于零信任数据访问控制系统提供的算力等。
事实上，针对不同的应用、不同的接口、不同的接口分支，通常需要制订不同的数据访问策略，因此，需要将这些策略限定在不同的使用范围(作用域)之内进行管理。
在本说明书一个可选的实施例中，基于零信任数据访问控制系统可以根据所述信任数据访问控制系统中预先设定的全局策略(全局策略作用域可以控制全部策略)中，确定出与所述指定信息匹配的全局策略，作为全局目标策略；从所述全局目标策略包含的应用策略(应用策略作用域可以控制一个应用的全部策略)中，确定出与所述指定信息匹配的应用策略，作为应用目标策略；从所述应用目标策略包含的接口组策略(应用中的多个接口可以划分为不同的接口组，每个接口组策略作用域可以控制组内所有接口的策略)中，确定出与所述指定信息匹配的接口组策略(每个接口组由多个接口构成，接口组策略作用域可以控制该接口组下所有接口策略)，作为接口组目标策略；将所述接口组目标策略包含的接口策略(每个接口策略又由多个接口分支策略构成，接口策略作用域可以控制该接口下所有接口分支策略)中，确定出与所述指定信息匹配的接口策略，作为接口目标策略。从接口目标策略包含的接口分支策略中，确定出与所述指定信息匹配的接口分支策略，接口分支策略(而接口分支策略作用域仅限于控制该接口分支的策略，接口分支策略对分支数据执行访问控制，分支数据为可执行访问控制数据的最小单元)之一，作为目标策略。则在前述的步骤S102中，可以根据各个备选策略的层级属性，对备选策略建立倒排索引，之后匹配策略的过程可以是基于倒排索引进行的查找过程。
下文中，将前述的全局策略-应用策略……这样范围由粗到细的策略层级，成为分组策略。分组策略会在所属分组下启用了访问控制的接口中生效，组策略可以是行策略也可以是列策略，行策略适用于对该组接口进行行数据的访问控制，列策略适用于对该组接口进行列数据的访问控制。例如，按企业的各分公司展示数据，属于对行数据的控制，所建组策略应为行策略属性。分组策略作用于本组启用了访问控制的接口下的数据分支，组策略可有多条，行属性的 组策略对该组所有接口返回数据的行执行访问控制，列属性的组策略对该组所有接口返回数据的列执行访问控制。接口策略对接口下返回的数据执行访问控制，接口策略可以是行策略也可以是列策略，接口策略对接口下启用了访问控制，且分支上无任何策略或分支所有策略被禁用的所有分支生效。
本说明书中的方法针对不同的应用、不同的接口、不同的接口分支，制订不同的数据访问策略，并将这些策略限定在不同的使用范围(作用域)之内进行管理。本说明书中的方法为分支数据制定分支策略，可实现精准的数据访问控制，而分支策略对其他分支不会产生任何影响，分支策略仅对启用了访问控制的分支生效，分支策略的影响范围最小。。可通过类似全局策略作用域、应用策略作用域、接口组策略作用域、接口策略作用域、接口分支策略作用域这种分级管理模式设置不同的策略管理范围，实现灵活精准的数据访问控制，如图4所示，图4展示出了分组策略在影像范围。
基于访问控制生效的条件控制各类型策略生效的开关配置如以下表2所示。
表2
禁用分支/接口/应用的访问控制如以下表3所示。
表3

在本说明书一个可选的实施例中，基于零信任数据访问控制系统的架构如图5所示。在图5所示的系统架构中，基于零信任数据访问控制系统包括DAC(Data Access Control)管理控制台、DAC服务器以及DAC控制器。
(1)DAC管理控制台
DAC管理控制台是用于基于管理员的指令对数据访问控制策略进行编辑、管理、下发，对各类日志进行查看及分析的操作控制组件。
具体地，在步骤S100中进行策略配置及下发时，管理员通过DAC管理控制台根据不同应用包含的各业务单元的各自的业务逻辑，结合相应的数据访问控制需求，通过策略配置管理功能完成上述数据访问控制策略编辑(生成备选策略)及策略管理(例如，针对备选策略的添加、删除、修改等)，并保存备选策略配置到DAC服务器，同时可以通过DAC服务器将备选策略同步给多个DAC控制器，完成策略下发。
在进行日志查看及分析时，DAC服务器和DAC控制器在运行过程中会产生各类日志，如系统日志、操作日志、数据访问日志、策略流程日志等。这些日志会被存储在DAC服务器或单独的存储设备中。操作管理员可以通过DAC管理控制台查看各类日志，同时通过日志分析发现各类异常情况，如系统异常、操作 异常、数据访问异常、策略流程异常等，从而帮助管理员发现并解决问题。
(2)DAC服务器
DAC服务器(DAC Server)是用于存储数据访问控制策略以及各类日志信息，同时负责将策略同步至DAC控制台、收集DAC控制器日志以及和第三方系统同步数据等工作的组件。
在执行策略存储和日志存储时，管理员配置好的备选策略需要通过DAC服务器存储在DAC服务器或单独的存储设备中，以便进一步的策略管理或策略同步等操作；同时DAC系统各部分产生的各类日志也需要DAC服务器存储在DAC服务器或单独的存储设备中，以便进一步查看或分析。
策略同步是指将管理员配置好的备选策略从DAC服务器同步至指定的DAC控制器，以便DAC控制器根据数据访问策略执行数据访问控制。在执行策略同步时，可以通过DAC服务器将策略推送至DAC控制器上的方式实现，也可以通过DAC控制器从DAC服务器上拉取策略等方式实现。
日志同步是指将DAC控制器所产生的各类日志同步至DAC服务器，并存储在DAC服务器或单独的存储设备中，以便管理员查看及分析。在执行日志同步时，可以通过DAC服务器到DAC控制器上拉取日志的方式实现，也可以通过DAC控制器将日志上传或推送至DAC服务器或单独的存储设备中等方式实现。
此外，在策略编辑过程中，为构建策略要素(策略上下文)，通常需要提前从第三方获取相关数据，比如，从AD(域管理系统)、IAM(身份访问管理系统)获取用户身份及权限等信息，从数据库、大数据平台获取数据属性等信息，从终端准入软件、零信任SDP系统中获取终端及服务器环境等信息，因此，需要从第三方获取相关数据。通常，第三方数据同步可以在使用时通过实时方式从第三方获取，也可以提前通过非实时方式定期从第三方获取，保存在本地DAC服务器或单独的存储设备中，使用时再从本地获取。
(3)DAC控制器
DAC控制器(DAC Controller)是具体执行数据访问控制策略的组件，该组件以SDK方式部署并运行在应用程序(Application)中的，可以通过与DAC服务器的配合执行策略和日志同步。
此外，DAC控制器还可以用于执行本说明书中的基于零信任数据访问控制系统的数据处理方法。
在DAC控制器执行引擎调用时，由于DAC控制器通过SDK方式部署并运行 在应用程序(Application)中，应用程序在取得原始业务数据后，可调用DAC控制器中的DAC策略执行引擎相关接口，并输入原始业务数据以及相关上下文信息，DAC策略执行引擎首先根据相关上下文信息构造策略要素，再通过策略要素进行策略匹配，最后按照所匹配的策略规则对原始业务数据执行对应的规则操作，完成对原始业务数据的访问控制，最终将已处理的业务数据返回给应用程序；一旦同步到DAC控制器的策略发生变化，DAC策略执行引擎会根据最新的策略执行访问控制，因此管理员可根据业务需求动态调整策略并即时生效。
在DAC控制器执行输入时，应用程序调用DAC策略执行引擎的接口主要输入两部分数据：1、原始业务数据，即要进行数据访问控制操作的数据对象；2、用户信息、环境信息、业务操作信息等上下文信息，便于构造策略要素，执行策略匹配。
DAC策略执行引擎被目标应用调用之后，相应执行过程如下：1、根据输入的用户信息、环境信息、业务操作信息等上下文信息的构造数据访问控制策略要素；2、根据策略要素匹配数据访问控制策略；3、如果匹配到行策略，则执行行级数据访问控制策略；4、如果匹配到列策略，则执行列级数据访问控制策略；5、如果匹配到单元策略，则执行单元级数据访问控制策略；策略执行完成后，将已处理的业务数据返回给目标应用。
本说明书中的方法秉承从不信任、最小权限、持续验证等零信任理念，进一步拓展了零信任对数据侧的访问控制能力，同时，细化了零信任对于数据访问控制的粒度，并通过基于业务逻辑的策略编辑和策略管理实现动态精细化的数据访问控制，解决了技术落地的关键问题，最后通过完整的零信任数据访问控制系统架构实现了完整的从策略编辑、策略下发到策略执行的完整系统构成，让用户可以根据业务逻辑的变化及时通过策略编辑的方式完成策略调整，并下发执行即时生效，既避免了传统数据库防火墙、数据库脱敏等产品无法根据业务逻辑提供精细化访问控制的问题，又解决了传统硬编码导致业务耦合，造成应用程序开发、更新以及维护困难等灵活性问题，真正实现基于零信任的动态精细化数据访问控制。
本说明书中的“生成备选策略”包括创建备选策略和/或修改备选策略的过程。
现就如何生成备选策略进行说明。在本说明书一个可选的实施例中，首先确定功能位置，具体地，数据访问控制平台->应用管理->应用的操作列.API访 问控制->应用接口策略配置->接口管理->接口分组下接口的操作列->接口管理->策略管理。然后，触发新增接口策略，将备选策略名称添加至策略属性编辑窗口。之后，选择备选策略类型，可选项有列策略，行策略，大部分情况选列策略。其中，列策略用于控制返回数据中对敏感字段的脱敏或移除，行策略用于控制返回数据中对数据集结果进行过滤，只返回部分数据。然后，选择策略是否与数值有关，大部分情况选是。如选择是，每条数据都会执行该策略，再返回执行结果；选择"否"则策略与数值无关，在第一条数据执行该策略后，缓存执行结果，后面的数据不会执行策略而是直接使用缓存的结果；如果策略与数据值无关，性能将获得大幅提升。响应于策略配置完成的操作，一条未配置策略流程的列策略创建成功。
在对策略进行编辑时，首先，响应于针对新创建的列策略里操作列中的编辑策略的触发操作，获取针对编辑流程页面编辑需要的流程内容采集的编辑数据。然后，配置策略条件，具体地，选择条件边，获取该条件的执行优先级。优先级越高的规则越被优先执行，当被访问的数据不满足优先级高的规则的条件时，则执行优先级仅次于它的规则。一旦匹配上优先级高的策略，则优先级低于它的策略均不会执行。响应于编辑ABAC条件的触发，获取在ABAB规则(ABAC规则边是ABAC规则的载体，通过规则边为策略设置执行优先级，配置ABAC条件)编辑窗口中配置策略条件数据。策略条件的格式：变量、运算符、变量(或常量)，其中变量的可配置为访问主体，访问客体，访问环境的信息；如果策略条件设为属性与阈值的判断，表示对属性为指定值的主体进行访问控制。响应于针对编辑的结果的保存操作，判断条件设置成功。
以对原始数据进行脱敏为例：
1)在根据数据分级执行动态脱敏时。
首先，确定过滤需求。例如，过滤需求是：需要脱敏所有分级>2级的数据，期望执行结果phone，idNumber，debitCardNumber，password，debitCardBalance被脱敏，其他数据保留。
然后，进行策略配置。例如，配置第一策略条件，之后，配置第一数据脱敏结束节点。然后，配置第二策略条件，之后，配置第二数据脱敏结束节点。
示例性地，在配置第一策略条件时，如果当前列的数据分级>2，具体操作如下：选中第一策略条件，配置该条件的执行优先级，触发编辑ABAC条件，设置ABAB规则编辑窗口中的访问客体里列数据客体的数据分级大于常量2，即能 设定对指定数据分级的数据处理。在配置第一数据脱敏结束节点时，将结点设置为数据被脱敏，具体操作如下：确定第二数据脱敏结束节点，触发编辑输出配置，执行结果代码，则选择数据被脱敏。
在配置第二策略条件时，与第一策略条件为非此即彼的关系，因此该条件无需配置策略规则。在配置第二数据脱敏结束节点时，将结点设置为保留原始数据。
脱敏效果为：数据分级大于2的数据被脱敏显示，数据分级小于等于2的数据原数据输出。
2)在根据当前访问者的角色进行动态脱敏时：
示例性地，过滤需求为：职务为总经理的角色在访问数据时，输出原始数据，其他职员访问数据时,银行卡号(debitCardNumber)被脱敏。注：访问者的应用账号传入setCtxAppAccount()对象，系统会根据传入的值，对访问者的身份进行判断。
在生成备选策略时，首先配置策略条件：如果访问数据的角色为总经理，ABAC规则设置为访问主体里账号主体的userPosition等于总经理，就能找到这个角色。然后，配置数据脱敏结束节点：对访问角色为总经理，保留原始数据。之后，配置策略条件：除了总经理角色，其他就是员工角色，因为不用设置ABAC判断规则对员工角色进行判断；其他职员访问数据时,银行卡号被脱敏：ABAC规则设置为访问客体里列数据客体为属性代码等于常量debitCardNumber，就能找到银行卡号属性的数据。然后，配置数据脱敏结束节点：对访问角色为员工，数据被脱敏。得到的脱敏效果为：总经理王经理访问职员信息时，返回原数据。职员张珣访问信息时，信息里的银行卡号被脱敏。
3)在根据数据的数值对数据进行动态脱敏时：
示例性地，过滤需求为：数据信息里银行卡余额大于1000的数据被访问时，将电话号动态脱敏，银行卡余额不大于1000的数值，保留原数据输出。
策略配置的过程为：首先配置策略条件。示例性地，如果银行卡余额大于1000，在ABAC策略编辑器里将访问客体里行数据客体的debitCardBalance大于1000；同时使用AND再设置一个条件，将条件配置为属性代码等于电话号码phone。然后，配置数据脱敏结束节点。例如，银行卡余额大于1000数值对应的电话号码，设置结点的输出数据被脱敏。之后，配置策略条件。例如，除了银行卡余额大于1000的数据，其他数据均为小于等于1000，不用设置ABAC判 断规则对其他数额进行判断。此后，配置数据脱敏结束节点。例如，对小于等于1000数值对应的电话号码，设置结点的输出为保留原始数据。得到的脱敏效果为：借记卡余额大于1000对应的电话号被脱敏显示。
4)在脱敏指定字段时。
示例性地，过滤需求为：对数据里的账号密码进行动态脱敏，期望执行结果为password字段被脱敏，其他信息保留原始数据。
策略配置的过程为：首先配置策略条件。例如如果数据为银行卡密码(password)字段，在ABAC策略编辑器里将访问客体里列数据客体的属性代码设置为password，即能设定对指定字段的数据处理。然后，配置数据脱敏结束节点。例如，为银行卡密码(password)字段的数据，数据被脱敏。之后，配置策略条件。例如，除了银行卡密码字段，其他数据均为非银行卡密码，不用设置ABAC判断规则对其他数额进行判断。然后，配置数据脱敏结束节点。例如，对非银行卡密码字段的数据，保留原始数据。得到的脱敏效果为：属性代码为password的字段动态脱敏。
5)在根据访问IP执行数据过滤。
示例性地，过滤需求为：系统识别到IP为192.168.53.2的客户端发起的访问请求，直接将数据过滤，无返回数据。
策略配置的过程为：首先配置策略条件。例如，如果发起数据访问请求的客户端IP为192.168.53.2，在ABAC编辑器中设置访问环境里客户端环境的客户端IP等于192.168.53.2，即能判断访问客户端IP为192.168.53.2。之后，配置数据脱敏结束节点。例如，发起数据访问请求的客户端IP为192.168.53.2，数据被移除。然后，配置策略条件。例如，除了客户端IP为192.168.53.2，其他数据均为非此客户端，不用设置ABAC判断规则对其他数额进行判断。之后，配置数据脱敏结束节点。例如，对其他客户端IP，保留原始数据。
基于同样的思路，本说明书实施例还提供了对应于图1所示部分过程的一种基于零信任数据访问控制系统的数据处理装置。
本说明书中的一种基于零信任数据访问控制系统的数据处理装置，可以包括以下模块中的一个或多个：
业务单元确定模块，配额为：确定目标应用包含的各个业务单元。
备选策略生成模块，配置为：针对每一个业务单元，根据所述业务单元的业务需求，将策略要素按照业务逻辑生成所述业务单元对应的备选策略；其中， 所述备选策略是处理其对应的业务单元时，可供执行的策略。
备选策略下发模块，配置为：将所述各个业务单元各自对应的备选策略，下发至所述基于零信任数据访问控制系统。
目标业务单元确定模块，配额为：响应于数据访问请求，将所述数据访问请求所针对的业务单元确定为目标业务单元。
指定信息确定模块，配额为：从所述目标业务单元的上下文信息，获取所述目标业务单元对应的指定信息；其中，所述上下文信息包括触发所述数据访问请求的访问主体的主体信息、所述数据访问请求针对的访问客体的客体信息中的至少一个。
数据访问策略确定模块，配额为：将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略。
执行模块，配额为：执行所述数据访问策略。
在本说明书一个可选的实施例中，所述指定信息还包括访问环境的环境信息。
在本说明书一个可选的实施例中，目标业务单元确定模块具体配额为：调用针对所述目标业务单元的业务逻辑；基于所述业务逻辑，调用数据访问；在基于所述调用数据访问的数据调用接口返回原始数据时，将所述数据访问请求所针对的业务单元确定为目标业务单元。
在本说明书一个可选的实施例中，执行模块具体配额为：确定所述数据访问策略针对的执行目标；其中，所述执行目标包括以下至少一种：所述访问客体对应的原始数据的数据行、所述访问客体对应的原始数据的数据列、所述访问客体对应的原始数据的数据单元；针对所述执行目标，执行所述数据访问策略。
在本说明书一个可选的实施例中，所述策略要素表示出确定数据访问策略时所采用的字段，所述指定信息由目标字段构成。
在本说明书一个可选的实施例中，数据访问策略确定模块具体配额为：将所述各个备选策略中，包含的策略要素与所述指定信息中的目标字段匹配的备选策略，作为数据访问策略。
在本说明书一个可选的实施例中，数据访问策略确定模块具体配额为：按照所述由高到低的次序，依次对备选策略和指定信息是否匹配进行比对；将确定出的第一个匹配的备选策略，作为数据访问策略。
在本说明书一个可选的实施例中，数据访问策略确定模块具体配额为：对所述访问客体对应的原始数据进行脱敏。
在本说明书一个可选的实施例中，对所述访问客体对应的原始数据进行替换。
在本说明书一个可选的实施例中，保留所述访问客体对应的原始数据。
在本说明书一个可选的实施例中，移除所述访问客体对应的原始数据。
图7是本申请的一个实施例电子设备的结构示意图。请参考图5，在硬件层面，该电子设备包括处理器，可选地还包括内部总线、网络接口、存储器。其中，存储器可能包含内存，例如高速随机存取存储器(Random-Access Memory，RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少1个磁盘存储器等。当然，该电子设备还可能包括其他业务所需要的硬件。
处理器、网络接口和存储器可以通过内部总线相互连接，该内部总线可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component Interconnect，外设部件互连标准)总线或EISA(Extended Industry Standard Architecture，扩展工业标准结构)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图5中仅用一个双向箭头表示，但并不表示仅有一根总线或一种类型的总线。
存储器，用于存放程序。具体地，程序可以包括程序代码，所述程序代码包括计算机操作指令。存储器可以包括内存和非易失性存储器，并向处理器提供指令和数据。
处理器从非易失性存储器中读取对应的计算机程序到内存中然后运行，在逻辑层面上形成一种基于零信任数据访问控制系统的数据处理方法。处理器，执行存储器所存放的程序，并具体用于执行前述任意一种基于零信任数据访问控制系统的数据处理方法。
上述如本申请图2所示实施例揭示的一种基于零信任数据访问控制系统的数据处理方法可以应用于处理器(即，本说明书中的删除控制模块)中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(Digital Signal Processor，DSP)、专用集成电路 (Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
该电子设备还可执行图2中一种基于零信任数据访问控制系统的数据处理方法，并实现图2所示实施例的功能，本申请实施例在此不再赘述。
本申请实施例还提出了一种计算机可读存储介质，该计算机可读存储介质存储一个或多个程序，该一个或多个程序包括指令，该指令当被包括多个应用程序的电子设备执行时，能够使该电子设备执行图2所示实施例中一种基于零信任数据访问控制系统的数据处理方法执行的方法，并具体用于执行前述的任意一种基于零信任数据访问控制系统的数据处理方法。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流 程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可删除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (10)

  1. 一种基于零信任数据访问控制系统的数据处理方法，其特征在于，所述方法包括：
    确定目标应用包含的各个业务单元；
    针对每一个业务单元，根据所述业务单元的业务需求，将策略要素按照业务逻辑生成所述业务单元对应的备选策略；其中，所述备选策略是处理其对应的业务单元时，可供执行的策略；
    将所述各个业务单元各自对应的备选策略，下发至所述基于零信任数据访问控制系统；
    响应于数据访问请求，将所述数据访问请求所针对的业务单元确定为目标业务单元；
    从所述目标业务单元的上下文信息，获取所述目标业务单元对应的指定信息；其中，所述上下文信息包括触发所述数据访问请求的访问主体的主体信息、所述数据访问请求针对的访问客体的客体信息中的至少一个；
    将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略；
    执行所述数据访问策略。
  2. 如权利要求1所述的方法，其特征在于，所述指定信息还包括访问环境的环境信息。
  3. 如权利要求1所述的方法，其特征在于，将所述数据访问请求所针对的业务单元确定为目标业务单元，包括：
    调用针对所述目标业务单元的业务逻辑；
    基于所述业务逻辑，调用数据访问；
    在基于所述调用数据访问的数据调用接口返回原始数据时，将所述数据访问请求所针对的业务单元确定为目标业务单元。
  4. 如权利要求2所述的方法，其特征在于，执行所述数据访问策略，包括：
    确定所述数据访问策略针对的执行目标；其中，所述执行目标包括以下至少一种：所述访问客体对应的原始数据的数据行、所述访问客体对应的原始数据的数据列、所述访问客体对应的原始数据的数据单元；
    针对所述执行目标，执行所述数据访问策略。
  5. 如权利要求1所述的方法，其特征在于，所述策略要素表示出确定数据访问策略时所采用的字段，所述指定信息由目标字段构成；其中，将所述零信 任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略，包括：
    将所述各个备选策略中，包含的策略要素与所述指定信息中的目标字段匹配的备选策略，作为数据访问策略。
  6. 如权利要求1所述的方法，其特征在于，所述备选策略按照优先级由高到低的次序排列；其中，将所述零信任数据访问控制系统中配置的所述各个备选策略中与所述指定信息匹配的备选策略，作为数据访问策略，包括：
    按照所述由高到低的次序，依次对备选策略和指定信息是否匹配进行比对；
    将确定出的第一个匹配的备选策略，作为数据访问策略。
  7. 如权利要求1所述的方法，其特征在于，执行所述数据访问策略，包括以下任意一种：
    对所述访问客体对应的原始数据进行脱敏；
    对所述访问客体对应的原始数据进行替换；
    保留所述访问客体对应的原始数据；
    移除所述访问客体对应的原始数据。
  8. 一种基于零信任数据访问控制系统的数据处理装置，其特征在于，所述装置用于实现权利要求1～7之任一所述方法。
  9. 一种电子设备，包括：
    处理器；以及
    被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理器执行所述权利要求1～7之任一所述方法。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储一个或多个程序，所述一个或多个程序当被包括多个应用程序的电子设备执行时，使得所述电子设备执行所述权利要求1～7之任一所述方法。
PCT/CN2023/098357 2022-08-05 2023-06-05 基于零信任数据访问控制系统的数据处理方法 WO2024027328A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210936733.0A CN115238247A (zh) 2022-08-05 2022-08-05 基于零信任数据访问控制系统的数据处理方法
CN202210936733.0 2022-08-05

Publications (1)

Publication Number Publication Date
WO2024027328A1 true WO2024027328A1 (zh) 2024-02-08

Family

ID=83679814

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/098357 WO2024027328A1 (zh) 2022-08-05 2023-06-05 基于零信任数据访问控制系统的数据处理方法

Country Status (2)

Country Link
CN (1) CN115238247A (zh)
WO (1) WO2024027328A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115238247A (zh) * 2022-08-05 2022-10-25 盈适慧众(上海)信息咨询合伙企业(有限合伙) 基于零信任数据访问控制系统的数据处理方法
CN116974708A (zh) * 2023-09-25 2023-10-31 北京众图识人科技有限公司 业务数据处理系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113051602A (zh) * 2021-01-22 2021-06-29 东南大学 一种基于零信任架构的数据库细粒度访问控制方法
CN113783844A (zh) * 2021-08-13 2021-12-10 中国光大银行股份有限公司 零信任访问控制方法、装置及电子设备
CN114218605A (zh) * 2021-12-14 2022-03-22 中国建设银行股份有限公司 数据访问控制方法、装置、设备及存储介质
CN114499922A (zh) * 2021-11-30 2022-05-13 中国大唐集团科学技术研究总院有限公司 一种智能化的零信任动态授权方法
US20220210173A1 (en) * 2020-12-31 2022-06-30 Fortinet, Inc. Contextual zero trust network access (ztna) based on dynamic security posture insights
CN115238247A (zh) * 2022-08-05 2022-10-25 盈适慧众(上海)信息咨询合伙企业(有限合伙) 基于零信任数据访问控制系统的数据处理方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220210173A1 (en) * 2020-12-31 2022-06-30 Fortinet, Inc. Contextual zero trust network access (ztna) based on dynamic security posture insights
CN113051602A (zh) * 2021-01-22 2021-06-29 东南大学 一种基于零信任架构的数据库细粒度访问控制方法
CN113783844A (zh) * 2021-08-13 2021-12-10 中国光大银行股份有限公司 零信任访问控制方法、装置及电子设备
CN114499922A (zh) * 2021-11-30 2022-05-13 中国大唐集团科学技术研究总院有限公司 一种智能化的零信任动态授权方法
CN114218605A (zh) * 2021-12-14 2022-03-22 中国建设银行股份有限公司 数据访问控制方法、装置、设备及存储介质
CN115238247A (zh) * 2022-08-05 2022-10-25 盈适慧众(上海)信息咨询合伙企业(有限合伙) 基于零信任数据访问控制系统的数据处理方法

Also Published As

Publication number Publication date
CN115238247A (zh) 2022-10-25

Similar Documents

Publication Publication Date Title
US11128465B2 (en) Zero-knowledge identity verification in a distributed computing system
US11082226B2 (en) Zero-knowledge identity verification in a distributed computing system
WO2024027328A1 (zh) 基于零信任数据访问控制系统的数据处理方法
US20190097807A1 (en) Network access control based on distributed ledger
CN110943961B (zh) 数据处理方法、设备以及存储介质
US10410304B2 (en) Provisioning in digital asset management
US11553000B2 (en) Systems and methods for using namespaces to access computing resources
US10726146B2 (en) Data custodian model and platform for public clouds
US10645090B2 (en) Access control for objects having attributes defined against hierarchically organized domains containing fixed number of values
US11477179B2 (en) Searching content associated with multiple applications
US10491635B2 (en) Access policies based on HDFS extended attributes
US20230409968A1 (en) Multi-party machine learning using a database cleanroom
US20230077698A1 (en) Interspersed message batching in a database system
CN112835863A (zh) 操作日志的处理方法和处理装置
US11611882B2 (en) Automatically integrating security policy in mobile applications at build-time
CN111414591B (zh) 工作流管理的方法和装置
CN111797424A (zh) 处理请求的方法和装置
US11989173B2 (en) Query validation and processing in data clean rooms
US11734316B2 (en) Relationship-based search in a computing environment
US11995126B2 (en) Projection constraints enforced in a database system
US11928157B2 (en) Projection constraints in a query processing system
US11921887B2 (en) Decentralized identity metaverse database system
US20240176822A1 (en) Projection constraint policies in a database system
US20230153457A1 (en) Privacy data management in distributed computing systems
US20230153450A1 (en) Privacy data management in distributed computing systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23849038

Country of ref document: EP

Kind code of ref document: A1