CN109934011A - A data security partition method applied to operation and maintenance audit system - Google Patents

Abstract

The invention discloses a kind of data safety partition methods applied to O&M auditing system, O&M auditing system are divided into O&M target, O&M access area and the part of operating space three, wherein operating space includes monitoring management area, O&M Office Area and Bussiness office area；Database client operates on the application virtualization server of O&M auditing system, and operation maintenance personnel directly can not be saved data to local by database client on personal operation machine；The file between O&M operation machine and application virtualization server is cut off by transmission, data copy channel, is uploaded to again after preventing operation maintenance personnel from exporting to database file on virtualized server on O&M operation machine.The present invention can effectively solve the problem that existing O&M auditing system in daily O&M, and operation maintenance personnel can directly access certain data or even export to local, these data do not have corresponding safety measure to protect, and there are problems that the risk being illegally used.

Description

A data security partition method applied to operation and maintenance audit system

technical field

The invention relates to a data security partition method applied to an operation and maintenance audit system.

Background technique

Big data has become a national strategy, and the informatization construction of State Grid Corporation is in the ascendant. At the same time, with the continuous increase of digital and intelligent construction of disaster recovery data centers, cloud computing, big data, mobile office and smart devices, information security is facing new challenges. . The overall security construction of the big data platform, from data collection to the sorting of data assets, to the access security control and data storage security of the platform, as well as the copyright protection in the process of data sharing and distribution, how does the entire security scheme form a closed loop of data access and use process , and can realize the unified issuance and coordination of security policies, which is a thorny issue before platform construction.

The business functions of the existing operation and maintenance audit system mainly include five aspects: (1) parameter and policy configuration function; (2) resource management function; (3) security management function; (4) log management function; (5) security audit function . Among them, the parameter and policy configuration function provides parameters, functions and security policy configuration for the system; the resource management function realizes the management of resources such as personnel and equipment; the security management function realizes the security authentication and control functions of the system; the log management function realizes various system functions Log analysis, statistics and display; the security audit function realizes the recording, analysis, control, monitoring and playback of operation and maintenance operations.

In daily operation and maintenance, the following high-risk operations are performed for the existence of data:

In daily operation and maintenance, operation and maintenance personnel can directly access some data or even export it locally. These data are not protected by corresponding security measures, and there is a risk of being illegally used.

In the process of system implementation, launch, and testing, it is necessary to export real data for use, which increases the risk of data leakage.

When the system goes offline or there is a problem with the hard disk, a large amount of data retained in the hard disk is often easily overlooked. Even after deletion, formatting, etc., it is very easy to recover. In the process of hard disk repair and destruction, it is easy to leak data and cause serious consequences.

The ordinary operation and maintenance audit system only manages storage and access, and the security protection is not comprehensive enough; it only protects specific risk points, and does not form an overall linked security protection system.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a data security partitioning method applied to the operation and maintenance audit system, so as to solve the problem that in the daily operation and maintenance of the existing operation and maintenance audit system, the operation and maintenance personnel can directly access some data or even export the data locally. Without corresponding security measures to protect, there is a risk of illegal use; in the process of system implementation, launch, testing, etc., it is necessary to export real data for use, which increases the risk of data leakage; when the system is offline Or when there is a problem with the hard disk, the large amount of data retained in the hard disk is often easily overlooked, and even after deletion, formatting, etc., it is easy to recover, and it is easy to leak data during the process of hard disk repair and destruction. Serious consequences.

The general operation and maintenance audit system only manages storage and access, and the security protection is not comprehensive enough; it only protects specific risk points, and does not form an overall linked security protection system

The technical solution adopted by the present invention to solve the technical problem is: a data security partition method applied to an operation and maintenance audit system,

The operation and maintenance audit system is divided into three parts: the operation and maintenance target, the operation and maintenance access area and the operation area. The operation area includes the monitoring and management area, the operation and maintenance office area and the business office area;

The database client runs on the application virtualization server of the operation and maintenance audit system, and the operation and maintenance personnel cannot directly save the data locally through the database client on the personal operating machine;

Cut off the file transfer and data copy channels between the operation and maintenance operation machine and the application virtualization server, so as to prevent the operation and maintenance personnel from exporting the database files to the virtualized server and then uploading them to the operation and maintenance operation machine;

Turn off the file transfer function of a specific server and turn it on again when needed; it can prevent operation and maintenance personnel from exporting files on a specific server;

Perform refined management of network access policies between servers according to requirements, to avoid operation and maintenance personnel from making springboard access between servers, transferring files, and then fetching data through the springboard server;

The file transfer steps in the database operation and maintenance process are as follows:

Step (1), the administrator of the operation and maintenance area creates a new operation and maintenance task, and uploads the operation and maintenance scripts required in the operation and maintenance process to the bastion host;

In step (2), during operation and maintenance work, the operation and maintenance personnel are connected to the application virtualization server through virtualization;

Step (3), the system automatically synchronizes the script file required for operation and maintenance to the application virtualization server, so that the file is valid in the user's session;

Step (4), the database operation and maintenance work is carried out normally, and the data file may be exported to the application virtualization server in the process;

Step (5), the system automatically synchronizes the operation and maintenance export data file to the operation and maintenance data file server;

In step (6), the business personnel obtain the required data files.

Beneficial effects of the present invention: The data security partition method applied to the operation and maintenance audit system realizes the management of various elements in the operation and maintenance area, such as special areas, special planes, personnel, etc.; realizes the operation and maintenance work occurring in the operation and maintenance area. Comprehensive audit, to achieve orderly allocation of special operation and maintenance planes, real-time monitoring and post-audit of the operation of special operation and maintenance planes, strict certification of operation and maintenance personnel, remote management of special operation and maintenance planes, etc., so as to realize remote operation and maintenance operations Safe and controllable to ensure the safe and stable operation of the information system. It solves the problem that the previous operation and maintenance audit system only manages storage and access, and the security protection is insufficient; it only protects specific risk points, and does not form an overall linked security protection system. By partitioning the file management and cutting off the file transmission channel, the problem that the previous operation and maintenance audit system could not effectively control the data flow and the data was easily exported through various channels was solved. Through refined processing of network access policy settings between servers, the problem of operation and maintenance personnel doing springboard access between servers, transferring files, and then retrieving data through the springboard server is avoided.

The present invention will be described in more detail below with reference to the accompanying drawings and embodiments.

Description of drawings

Figure 1 is a schematic diagram of the present invention.

Detailed ways

Embodiment 1, as shown in FIG. 1, is a data security partitioning method applied to an operation and maintenance audit system. The operation and maintenance audit system is divided into three parts: an operation and maintenance target, an operation and maintenance access area, and an operation area. Including monitoring and management area, operation and maintenance office area and business office area;

The database client runs on the application virtualization server of the operation and maintenance audit system, and the operation and maintenance personnel cannot directly save the data locally through the database client on the personal operating machine;

Cut off the file transfer and data copy channels between the operation and maintenance operation machine and the application virtualization server, so as to prevent the operation and maintenance personnel from exporting the database files to the virtualized server and then uploading them to the operation and maintenance operation machine;

Turn off the file transfer function of a specific server and turn it on again when needed; it can prevent operation and maintenance personnel from exporting files on a specific server (such as a database server) ;

Perform refined management of network access policies between servers (such as between servers in the management information area) according to requirements, so as to avoid operation and maintenance personnel from making springboard access, transferring files between servers, and then retrieving data through the springboard server ;

The file transfer steps in the database operation and maintenance process are as follows:

Step (1), the administrator of the operation and maintenance area creates a new operation and maintenance task, and uploads the operation and maintenance scripts required in the operation and maintenance process to the bastion host;

In step (2), during operation and maintenance work, the operation and maintenance personnel are connected to the application virtualization server through virtualization;

Step (3), the system automatically synchronizes the script file required for operation and maintenance to the application virtualization server, so that the file is valid in the user's session;

Step (4), the database operation and maintenance work is carried out normally, and the data file may be exported to the application virtualization server in the process;

Step (5), the system automatically synchronizes the operation and maintenance export data file to the operation and maintenance data file server;

In step (6), the business personnel obtain the required data files.

The present invention has been exemplarily described above with reference to the accompanying drawings. Obviously, the specific implementation of the present invention is not limited by the above manner. As long as the method concept and technical solution of the present invention are adopted for various non-substantial improvements; or the above-mentioned concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention. within.

Claims (1)

1. a kind of data safety partition method applied to O&M auditing system, it is characterised in that:

O&M auditing system is divided into O&M target, O&M access area and the part of operating space three, wherein operating space includes prison Control directorial area, O&M Office Area and Bussiness office area；

Database client operates on the application virtualization server of O&M auditing system, and operation maintenance personnel is on personal operation machine Directly data can not be saved to local by database client；

The file between O&M operation machine and application virtualization server is cut off by transmission, data copy channel, prevents O&M people Member uploads on O&M operation machine again after exporting to database file on virtualized server；

Particular server file transmitting function is closed, is opened again when needed；It can be to avoid operation maintenance personnel in particular server Upper export；

According to demand between each server network access policies carry out fine-grained management, avoid operation maintenance personnel server it Between do springboard access, transmission file, then data are taken away by springboard server；

File transmitting step during database O&M is as follows:

Step (1), O&M prefecture administrator create O&M task, and O&M script needed for O&M process are uploaded to together Fort machine；

When step (2), progress maintenance work, operation maintenance personnel is connected to application virtualization server by virtualization；

Script file needed for O&M is synchronized on application virtualization server by step (3), system automatically, makes file in the user Session in effectively；

Step (4), database maintenance work are normally carried out, and are possible to export data file in the process to application virtualization service On device,；

O&M export data file is synchronized on operation/maintenance data file server by step (5), system automatically；

Data file needed for step (6), business personnel obtain.