1
compliance_requirements:
2
  # 个人信息保护
3
  pIPL:
4
    - 知情同意
5
    - 最小必要
6
    - 存储期限
7

8
  # 金融数据
9
  financial:
10
    - PCI-DSS 支付卡
11
    - 人民银行指引
12

13
  # 医疗数据
14
  medical:
15
    - HIPAA
16
    - 等保 2.0 三级

1
data_classification:
2
  # 绝密
3
  top_secret:
4
    color: RED
5
    encryption: mandatory
6
    access: individual_approval
7
    examples:
8
      - 核心算法
9
      - 密钥
10

11
  # 机密
12
  confidential:
13
    color: ORANGE
14
    encryption: required
15
    access: role_based
16
    examples:
17
      - 客户数据
18
      - 财务报表
19

20
  # 秘密
21
  secret:
22
    color: YELLOW
23
    encryption: recommended
24
    access: department_approval
25
    examples:
26
      - 内部流程
27
      - 人事信息
28

29
  # 公开
30
  public:
31
    color: GREEN
32
    encryption: optional
33
    access: all
34
    examples:
35
      - 公开文档
36
      - 新闻稿

1
class DataClassifier:
2
    def __init__(self):
3
        self.model = load_model("classifier_v2")
4

5
    def classify(self, content: str, metadata: dict) -> str:
6
        # 1. 规则匹配
7
        if self.rule_match(content):
8
            return self.rule_label
9

10
        # 2. NLP 模型分类
11
        features = self.extract_features(content)
12
        label = self.model.predict(features)
13

14
        # 3. 置信度检查
15
        if self.confidence < 0.8:
16
            return "unknown"
17

18
        return label
19

20
    def rule_match(self, content: str) -> bool:
21
        # 关键词规则
22
        sensitive_keywords = [
23
            "身份证", "手机号", "银行卡",
24
            "密码", "密钥", "token"
25
        ]
26
        return any(kw in content for kw in sensitive_keywords)

1
endpoint_dlp:
2
  # 策略规则
3
  policies:
4
    - name: "防止信用卡号外发"
5
      priority: high
6
      actions:
7
        - block
8
        - log
9
        - notify_supervisor
10
      conditions:
11
        content_pattern: '\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
12

13
    - name: "禁止源代码外传"
14
      priority: high
15
      actions:
16
        - block
17
        - quarantine
18
      conditions:
19
        file_type: [".go", ".java", ".py", ".js"]
20
        action: upload_to_cloud

1
network_dlp:
2
  # 邮件 DLP
3
  email:
4
    enabled: true
5
    policies:
6
      - name: "邮件附件敏感检测"
7
        direction: out
8
        attachment_scan: true
9
        content_inspection:
10
          - credit_card
11
          - ssn
12
          - custom_keywords
13

14
  # Web DLP
15
  web:
16
    enabled: true
17
    modes:
18
      - proxy
19
      - icap
20
    policies:
21
      - name: "云盘上传检测"
22
        destination: [google_drive, onedrive, dropbox]
23
        action: block_and_alert

1
encryption_policy:
2
  # 静态加密
3
  at_rest:
4
    database:
5
      algorithm: AES-256-GCM
6
      key_manager: aws_kms
7

8
    file_storage:
9
      algorithm: AES-256
10
      key_rotation: 90d
11

12
  # 传输加密
13
  in_transit:
14
    protocol: TLS 1.3
15
    min_version: TLS 1.2
16
    cipher_suites:
17
      - TLS_AES_256_GCM_SHA384
18
      - TLS_CHACHA20_POLY1305_SHA256
19

20
  # 应用层加密
21
  application:
22
    field_level:
23
      - fields: [password, ssn, credit_card]
24
        algorithm: AES-256-GCM

1
class DataMasking:
2
    """数据脱敏工具"""
3

4
    def mask_email(self, email: str) -> str:
5
        """邮箱脱敏"""
6
        parts = email.split('@')
7
        name = parts[0]
8
        domain = parts[1]
9
        masked = name[0] + '*' * (len(name) - 2) + name[-1]
10
        return f"{masked}@{domain}"
11

12
    def mask_phone(self, phone: str) -> str:
13
        """手机号脱敏"""
14
        return phone[:3] + '****' + phone[-4:]
15

16
    def mask_id_card(self, id_card: str) -> str:
17
        """身份证号脱敏"""
18
        return id_card[:6] + '********' + id_card[-4:]
19

20
    def mask_credit_card(self, card: str) -> str:
21
        """信用卡脱敏"""
22
        return '*' * 12 + card[-4:]
23

24
    def tokenize(self, value: str) -> str:
25
        """令牌化"""
26
        return hashlib.sha256(value.encode()).hexdigest()[:16]

1
masking_rules:
2
  # 测试环境
3
  test_env:
4
    pii:
5
      email: email_mask
6
      phone: phone_mask
7
      id_card: id_mask
8

9
  # 开发环境
10
  dev_env:
11
    pii:
12
      email: tokenize
13
      phone: tokenize
14
      id_card: tokenize
15

16
  # 生产环境
17
  prod_env:
18
    pii:
19
      email: none # 不脱敏
20
      phone: phone_mask
21
      id_card: id_mask

1
database_security:
2
  # 账户管理
3
  accounts:
4
    - name: app_readonly
5
      privileges: SELECT
6
      host: app-server%
7

8
    - name: app_write
9
      privileges: SELECT, INSERT, UPDATE
10
      host: app-server%
11

12
    - name: dba_admin
13
      privileges: ALL
14
      host: admin.internal
15

16
  # 审计
17
  audit:
18
    enabled: true
19
    log_level: ERROR
20
    slow_query_threshold: 1s

1
-- 敏感字段脱敏查询
2
SELECT
3
    id,
4
    name,
5
    mask_email(email) AS email,
6
    mask_phone(phone) AS phone,
7
    mask_id_card(id_card) AS id_card,
8
    mask_credit_card(credit_card) AS credit_card
9
FROM users;
10

11
-- 行级安全策略
12
CREATE POLICY user_privacy ON users
13
    FOR SELECT
14
    USING (user_id = current_user_id()
15
           OR has_role('admin'));

1
class FederatedLearning:
2
    """联邦学习框架"""
3

4
    def train(self, local_data):
5
        # 1. 本地训练
6
        local_gradient = self.local_train(local_data)
7

8
        # 2. 梯度加密
9
        encrypted = self.encrypt_gradient(local_gradient)
10

11
        # 3. 上报聚合
12
        return self.send_to_server(encrypted)
13

14
    def aggregate(self, gradients):
15
        # 4. 密态聚合
16
        global_model = self.secure_aggregate(gradients)
17

18
        # 5. 广播更新
19
        return global_model

1
tee_configuration:
2
  provider: intel_sgx
3

4
  # 内存保护
5
  memory:
6
    epc_size: 128MB
7
    page_swapping: disabled
8

9
  # 远程认证
10
  remote_attestation:
11
    enabled: true
12
    mr_enclave: measured_hash

1
data_processing_record:
2
  # 处理活动记录
3
  processing_activities:
4
    - data_subject: user
5
      data_categories: [identity, contact, behavior]
6
      purposes: [service_delivery, analytics]
7
      legal_basis: consent
8
      retention_period: 2y
9

10
    - data_subject: employee
11
      data_categories: [identity, financial]
12
      purposes: [hr_management, payroll]
13
      legal_basis: contract
14
      retention_period: 7y

1
access_matrix:
2
  # 基于属性的访问控制
3
  abac:
4
    attributes:
5
      - user.clearance
6
      - data.classification
7
      - environment.security_level
8

9
    policies:
10
      - name: "高级用户访问高级数据"
11
        condition: |
12
          user.clearance >= data.classification
13
        effect: permit