海上油气勘探开发数据权限管控方案设计与实践

Design and Practice of Data Permission Control Scheme for Offshore Oil and Gas Exploration and Development

摘要: 油气勘探开发过程中会产生大量敏感数据，大型数据管理平台的建设对做好敏感数据安全管控提出了更高要求，数据权限管理是其中最基础，同时也是最复杂的部分。针对该问题，通过分析油气勘探开发数据业务特点和数据权限管理需求，在经典的基于角色的访问控制(RBAC)和基于属性的访问控制(ABAC)权限管理模型基础上，提出了一种融合式数据权限管理方案。该方案在数据安全分类分级基础上，将用户和数据的多维属性进行提炼、对齐，并建立了同类属性信息匹配、校验机制，进而实现了从组织、角色、个人三个层次对不同安全级别的数据集、数据项、作用对象进行权限管控，且具备进一步灵活扩展能力。研究成果在中国海油勘探开发数据湖平台中落地实施，取得了良好应用效果，也可为其他同类大型数据管理平台数据权限管控问题提供借鉴。

Abstract: A large volume of sensitive data is generated during the process of oil and gas exploration and development, and the construction of large-scale data management platforms has raised higher requirements for the security control of such sensitive data. Data permission management is the most fundamental yet also the most complex component of this work. To address this issue, by analyzing the business characteristics of oil and gas exploration and development data and the requirements for data permission management, a hybrid data permission management scheme is proposed based on the classic Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models. On the basis of the classification and grading of data security, this scheme refines and aligns the multi-dimensional attributes of users and data, and establishes a matching and verification mechanism for homogeneous attribute information. Furthermore, it realizes permission control over data sets, data items and acting objects of different security levels from three dimensions: organization, role and individual, and features the capability for further flexible expansion. The research results have been implemented on the CNOOC Exploration and Development Data Lake Platform, achieving favorable application effects, and can also provide a reference for solving data permission control problems of other similar large-scale data management platforms.