CN113032804A

CN113032804A - Data security management method, device, equipment, system and storage medium

Info

Publication number: CN113032804A
Application number: CN202110303015.5A
Authority: CN
Inventors: 王新杰
Original assignee: Beijing Ai Si Technology Co ltd
Current assignee: Beijing Ai Si Technology Co ltd
Priority date: 2021-03-22
Filing date: 2021-03-22
Publication date: 2021-06-25

Abstract

The invention relates to a data security management method, a device, equipment, a system and a storage medium, comprising the following steps: and based on preset management requirements, the data document format on the in-network computing terminal is specified, and the data document format is stored to a local server in a non-inductive backup manner, and classified and graded safety management is performed. Transmitting and encrypting the target data document to a local server based on a preset encryption mode; clustering target data documents, and carrying out noninductive deletion on historical data documents on the in-network computing terminals; the in-network computing terminal user can use the deleted data document of the computing terminal through the local server. The invention has the beneficial effects that: the data files on the computing terminal which conform to the specified format are stored to the local server in an imperceptible, safe and encrypted mode through the network, so that the use and deletion management of the historical data files are achieved, manual operation of a user is not needed, the safety of enterprise data is improved, the safety control level of the enterprise data is improved, and the requirements of data safety laws and regulations are met.

Description

Data security management method, device, equipment, system and storage medium

Technical Field

The invention belongs to the technical field of data security, and particularly relates to a data security management method, device, equipment, system and storage medium.

Background

Data backup is the basis of enterprise disaster recovery, and refers to a process of copying all or part of a data set from a hard disk or an array of an application host to other storage media in order to prevent data loss caused by misoperation of a system or system failure. At present, a data backup mode of a medium-sized and small-sized enterprise usually adopts a mode of a specified path to backup files, so that the operation of a user is frequent, the user experience is poor, the safety is not guaranteed, and the requirement of the data management of the existing company cannot be met.

Disclosure of Invention

In order to solve the problems of frequent operation, poor user experience and the like in the prior art, the invention provides a data security management method, device, equipment, system and storage medium, which have the characteristics of higher security, convenience in operation, convenience in management and the like.

A data security management method according to a specific embodiment of the present invention includes:

the method comprises the steps that the format of a data document needing safety management on an in-network computing terminal is appointed based on preset management requirements, a target data document meeting the appointed format is stored to a local server in a non-inductive backup mode, and classified and graded safety management is carried out;

transmitting the target data document to a local server based on a preset encryption mode, and encrypting and storing the target data document based on a preset encryption algorithm;

and clustering the encrypted target data documents based on a preset classification grading rule, and carrying out noninductive deletion on historical data documents on the in-network computing terminal based on the preset rule, wherein the deleted data documents of the computing terminal can be used by an in-network computing terminal user through a local server based on the preset rule.

Further, the data document format which needs to be safely managed on the in-network computing terminal is specified based on the preset management requirement, and the target data document conforming to the specified format is invisibly backed up to the local server, wherein the document format at least comprises: DOC, DOCX, PPT, PPTX, XLS, and XLSX formats.

Further, the transmitting the target data document to the local server based on the preset encryption mode includes:

transmitting the target document to a server based on HTTPS encryption.

Further, the encrypting and storing the target data document based on a preset encryption algorithm includes:

and encrypting and storing the target data document based on a state-secret four-level algorithm.

Further, the clustering the encrypted target data documents based on the preset classification and classification rule includes:

and carrying out non-inductive deletion on the historical data document on the in-network computing terminal based on a preset rule.

Further, the data management method further comprises the steps of receiving an HTTPS request of a user, decrypting the corresponding file and transmitting the file.

According to a specific embodiment of the present invention, a data security management apparatus includes:

the backup module is used for appointing the format of a data document needing safety management on the in-network computing terminal based on the preset management requirement, storing the non-inductive backup of a target data document conforming to the appointed format to the local server, and performing classified grading safety management;

the encryption module is used for transmitting the target data document to the local server based on a preset encryption mode and carrying out encryption storage on the target data document based on a preset encryption algorithm; and

the classification module is used for carrying out noninductive deletion on the historical data document on the in-network computing terminal based on a preset rule; based on the preset rule, the deleted data document of the computing terminal can be used by a user of the computing terminal in the network through the local server.

According to the data security management device provided by the embodiment of the invention, the data security management device comprises a memory and a processor, wherein the memory stores a computer program, and the processor is used for calling and executing the computer program in the memory to realize the data management method.

According to the data security management system provided by the embodiment of the invention, the data security management system comprises a server and the data management device connected with the server, wherein the server is used for encrypted storage of data.

According to a storage medium provided by an embodiment of the present invention, the storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the steps of the data security management method as described above.

The invention has the beneficial effects that: the data files conforming to the specified format are backed up to the local through the network, transmitted to the server through encryption, stored in an encrypted mode through a preset encryption algorithm and deleted according to the setting of a user. The enterprise employee work data is noninductive, automatically backed up, safely stored and managed without manual operation of employees, the security of the enterprise data is improved through encryption storage, the data security management and control level of the enterprise is improved, and various legal and legal requirements of the state on the enterprise data security are better met.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

FIG. 1 is a flow diagram of a method for data security management provided in accordance with an exemplary embodiment;

FIG. 2 is a schematic diagram of a data security management apparatus provided in accordance with an example embodiment;

FIG. 3 is a schematic diagram of a data security management device provided in accordance with an exemplary embodiment;

FIG. 4 is a schematic diagram of a data security management system provided in accordance with an exemplary embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be described in detail below. It is to be understood that the described embodiments are merely exemplary of the invention, and not restrictive of the full scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the examples given herein without any inventive step, are within the scope of the present invention.

Referring to fig. 1, an embodiment of the present invention provides a data security management method, which specifically includes:

101. the method comprises the steps that the format of a data document needing safety management on an in-network computing terminal is appointed based on preset management requirements, a target data document meeting the appointed format is stored to a local server in a non-inductive backup mode, and classified and graded safety management is carried out;

the method comprises the steps of firstly, specifying a format of a document to be backed up according to the requirement of enterprise document management, scanning a storage device such as a magnetic disk of corresponding equipment after the setting is finished, filtering the document, and transmitting the document which conforms to the specified format to the local for backup through a network.

102. Transmitting the target data document to a local server based on a preset encryption mode, and encrypting and storing the target data document based on a preset encryption algorithm;

the method comprises the steps of scanning a document with a designated format in a memory, transmitting the document to a server after encryption, encrypting and storing the document through an encryption algorithm, sending a corresponding request if a user needs to download the document, then decrypting the corresponding request, and transmitting the decrypted designated document or file.

103. Based on a preset rule, carrying out noninductive deletion on a historical data document on the in-network computing terminal; based on the preset rule, the deleted data document of the computing terminal can be used by a user of the computing terminal in the network through the local server.

And clustering the documents according to the specific requirements of enterprises on the confidentiality of the data documents and the information specified by the users. Therefore, the deleting function of a certain data document can be realized, and all related data documents can be deleted after the deletion is determined, so that the management operation of a user is facilitated.

Therefore, the method and the device have the advantages that the work data of the enterprise staff are not sensitized, automatically and safely stored and managed, staff manual operation is not needed, user experience is improved, the safety of the enterprise data is improved through an encryption storage mode, the enterprise can delete the client data according to the importance degree of the data documents, and the data management and control capability of the enterprise is improved.

As a feasible implementation manner of the above embodiment, a data document format that needs security management on a computer in a network may be specified based on preset management requirements, and a target data document that conforms to the specified format is stored in a local server through network noninductivity, security and encryption, where the document format at least includes: DOC, DOCX, PPT, PPTX, XLS, and XLSX formats.

Transmitting the target data document to the server based on the preset encryption mode includes:

the target document is transmitted to the server based on HTTPS encryption. HTTPS (fully known as Hypertext Transfer Protocol over Secure Socket Layer) is an HTTP channel targeted for security, and simply a Secure version of HTTP. Namely, an SSL layer is added under HTTP, and the security base of HTTPS is SSL.

It is a URI scheme (abstract identifier system) that is syntactically similar to the http: system. For secure HTTP data transfer. URL indicates that it uses HTTP, but HTTPs has a default port different from HTTP and an encryption/authentication layer (between HTTP and TCP). Authentication and encrypted communication methods are provided and are now widely used for security sensitive communications over the world wide web, such as in transaction payments.

The network browser is developed by Netscape, is built in a browser of the network browser, and is used for compressing and decompressing data and returning a result transmitted back on a network. HTTPS actually applies Netscape's Secure Socket Layer (SSL) as a sub-layer to the HTTP application layer. (HTTPS uses port 443 instead of port 80 to communicate with TCP/IP as in HTTP.) SSL uses a 40-bit key as the RC4 stream encryption algorithm, which is appropriate for encryption of business information. HTTPS and SSL support the use of x.509 digital authentication, where the user can confirm who the sender is if desired. Thus, an information security channel is established to ensure the security of data transmission and the authenticity of data.

The encrypting and storing of the target data document based on the preset encryption algorithm comprises the following steps:

and encrypting and storing the target document based on the state-secret four-level algorithm. The national cipher four-stage algorithm is a cipher algorithm identified by the national cipher bureau, wherein the four-stage algorithm SM4 is a packet data algorithm of the wireless local area network standard. Symmetric encryption, key length and packet length are 128 bits. Both the encryption algorithm and the key expansion algorithm adopt 32-round nonlinear iteration structures. The decryption algorithm has the same structure as the encryption algorithm, but the use sequence of the round keys is opposite, and the decryption round keys are the reverse sequence of the encryption round keys.

The algorithm adopts a nonlinear iteration structure, each iteration is given by a round function, wherein the round function is formed by compounding a nonlinear transformation and a linear transformation, and the nonlinear transformation is given by an S box.

The SM4 cryptographic algorithm uses modulo-2 addition and circular shifting as basic operations including:

basic password component: the SM4 cryptographic algorithm uses an S-box, a non-linear transformation τ, a linear transformation component L, a synthetic transformation T basic cryptographic component.

Round function: the SM4 cryptographic algorithm employs a structure that iterates over a basic round function. By using the basic code components, a round function can be formed. The round function of the SM4 cryptographic algorithm is a cryptographic function with words as processing units.

And (3) encryption algorithm: the SM4 cryptographic algorithm is a block algorithm. The data packet length is 128 bits and the key length is 128 bits. The encryption algorithm employs a 32-round iterative structure, using one round key per round.

And (3) decryption algorithm: the SM4 cryptographic algorithm is a pair operation, so the decryption algorithm has the same structure as the encryption algorithm, except that the order of use of the round cipher aluminum is reversed, and the decryption round key is the reverse order of the encryption round key.

And (3) a key expansion algorithm: the SM4 cryptographic algorithm uses a 128-bit encryption key and adopts a 32-round generation encryption structure, each round of encryption uses a 32-bit round key, and a total of 32 round keys are used. It is therefore necessary to generate 32 round keys from the encryption key using a key expansion algorithm.

Security of SM 4: the SM4 cryptographic algorithm can resist the existing attacks such as differential attack, linear attack and the like through the full analysis and test of specialized cryptographic mechanisms in China, so that the SM4 cryptographic algorithm is safe and reliable.

Clustering the encrypted target data documents based on a preset classification rule comprises:

and clustering the encrypted target data documents based on a preset classification and grading rule, and carrying out noninductive deletion on the historical data documents calculated in the network.

Specifically, the general idea of realizing document clustering is to extract keywords from documents with words already divided and count word frequency; each document is then vectorized to facilitate subsequent clustering of the documents; and calculating the distance of the cosine after the vectorization is finished, and finally, clustering the documents by adopting a Kmeans clustering algorithm. Extracting keywords of each document to form a keyword set N, vectorizing each document, giving K clustering centers, processing the vectors by adopting a Kmeans clustering algorithm, and finally analyzing new related documents of each clustering center to obtain corresponding classification.

It is understood that other clustering methods can be used for classification by those skilled in the art, and the invention is not limited thereto.

In some embodiments of the present invention, the method further includes receiving an HTTPS request from a user and decrypting and transmitting a corresponding file. The user can send an HTTPS request according to actual requirements so as to decrypt the corresponding file, thereby facilitating various operations of the user on the document.

Based on the same design idea, fig. 2 is a schematic structural diagram of a data management apparatus according to a second embodiment of the present invention, and the apparatus is adapted to execute a data management method according to the second embodiment of the present invention. As shown in fig. 2, the apparatus may specifically include:

The data management device provided by the embodiment of the invention can execute the data management method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

The embodiment of the present invention shown in fig. 3 further provides a data security management device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor is used for calling and executing the computer program in the memory to implement the data management method according to the above embodiment.

The embodiment of the invention shown in fig. 4 further provides a data security management system, which comprises a server and the data management device connected with the server, wherein the server is used for encrypted storage of data.

In specific implementation, a client or a PC can be connected to the server layer through an API interface to perform operations such as storage encryption.

The embodiment of the present invention further provides a storage medium, where the storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the data security management method described in the above embodiment are implemented.

The data management method, the device, the equipment, the system and the storage medium provided by the embodiment of the invention can realize the full-disk non-inductive backup of data, reduce the repeated operation of the path designated by the user and improve the usability of the user; and the security of data is ensured: the local password four-level storage and transmission process (HTTPS protocol encryption); the enterprise controls the data of the client, and the client file deletion is supported, so that the data confidentiality is realized, and the operation of a user is facilitated.

It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.

In addition, functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc.

In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

What has been described above includes examples of one or more embodiments. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the aforementioned embodiments, but one of ordinary skill in the art may recognize that many further combinations and permutations of various embodiments are possible. Accordingly, the embodiments described herein are intended to embrace all such alterations, modifications and variations that fall within the scope of the appended claims. Furthermore, to the extent that the term "includes" is used in either the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term "comprising" as "comprising" is interpreted when employed as a transitional word in a claim. Furthermore, any use of the term "or" in the specification of the claims is intended to mean a "non-exclusive or".

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. a data security management method, is characterized in that, comprises:

Based on preset management requirements, specify the format of data files that need to be safely managed on the computing terminal in the network, and store the target data files that conform to the specified format in a non-inductive backup to the local server, and perform classified and hierarchical security management;

The target data file is transmitted to the local server based on the preset encryption method, and the target data file is encrypted and stored based on the preset encryption algorithm;

Based on the preset rules, historical data files on the in-network computing terminal are deleted without notice; based on the preset rules, the user of the in-network computing terminal can use the data files that have been deleted by the computing terminal through the local server.

2. The data security management method according to claim 1, wherein the data file format that needs to be managed safely on the computing terminal in the network is specified based on preset management requirements, and the target data file that meets the specified format is to be specified. The sensorless backup is stored in the local server, and the file formats include at least: DOC, DOCX, PPT, PPTX, XLS and XLSX.

3. The data security management method according to claim 1, wherein the transmitting the target data file to the server based on a preset encryption method comprises:

The target document is transmitted to the server based on HTTPS encryption.

4. The data security management method according to claim 1, wherein the encrypting and storing the target data file based on a preset encryption algorithm comprises:

The target document is encrypted and stored based on the national secret four-level algorithm.

5. The data security management method according to claim 1, wherein the clustering of the encrypted target documents based on a preset classification rule comprises:

The documents are clustered based on the keywords specified by the user, and the corresponding clustered documents are deleted by receiving the corresponding deletion information of the user.

6 . The data security management method according to claim 1 , further comprising receiving an HTTPS request from a user and decrypting a corresponding file for transmission. 7 .

7. A data security management device, characterized in that, comprising:

The backup module is used to designate the data file format that needs to be safely managed on the network computing terminal based on the preset management requirements, and store the target data file that conforms to the designated format to the local server for non-inductive backup, and perform classified and hierarchical security management;

The encryption module is used for transmitting the target data file to the local server based on a preset encryption method, and encrypting and storing the target data file based on the preset encryption algorithm;

The classification module is used to inadvertently delete the historical data files on the in-network computing terminal based on the preset rules; based on the preset rules, the user of the in-network computing terminal can use the deleted data files of the computing terminal through the local server.

8. A data security management device, characterized in that it comprises a memory and a processor, wherein a computer program is stored in the memory, and the processor is used to call and execute the computer program in the memory to realize the method as claimed in the claims The data security management method described in any one of 1 to 6.

9. A data security management system, characterized by comprising a server and the data security management device according to claim 8 connected to the server, wherein the server is used for encrypted storage of data.

10. A storage medium, characterized in that the storage medium stores a computer program, and when the computer program is executed by a processor, each step in the data security management method according to any one of claims 1-6 is implemented. .