基于分类的应用数据安全管控平台研究与实现  

Research and Implementation of Application Data Classified Security Control Platform

作　　者：杨永群 黄勤龙 刘越毅 

机构地区：[1]北京双洲科技有限公司,北京100101 [2]北京邮电大学网络空间安全学院,北京100876

出　　处：《网络空间安全》2017年第10期67-72,共6页Cyberspace Security

基　　金：北京市科技计划(D161100003316002);国家重点研发计划(2016YFB0800605)

摘　　要：论文针对大数据环境下的数据安全问题,研究透明加解密技术、数据库中间件技术,设计实现了基于分类的应用数据安全管控平台。同时,针对结构化数据,基于主客体分级访问控制规则设计数据库中间件模块,该中间件实现了对敏感表、字段的访问控制、安全审计等功能,使用户必须通过中间件模块认证后才能访问数据库;针对非结构化数据,采用服务器端透明加解密方案实现对数据的集中存储和管控,在保障用户原有操作习惯的同时,解决了数据所有权和管理权分离带来的安全隐患。Aiming at the problem of extensive data security protection in big data environment, this paper studies the transparent encryption and decryption, database middleware, designs and implements of an application data hierarchical security control platform. For the structured data, classified access control rule is designed for database middleware based on the data subject and object. The middleware realizes sensitive data field encryption, access control, security audit and other functions, which protects that only authorized users can correctly access the database through the middle layer authentication. For the unstructured data, transparent encryption scheme on the server is used to realize the centralized storage and control of data, which protects the original operating habits of users, and also solves the security risks brought by the separation of data ownership and management.

关 键 词：安全管控 数据库中间件 透明加解密 数据安全 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]