diff --git a/README.md b/README.md index ac949c90101cf92e8aa4f26c23dee99cc72015bd..fdfb2c8ad43068f9e89741d5c3021694f1d5badc 100644 --- a/README.md +++ b/README.md @@ -1,75 +1,58 @@ -# dataclassification +# Data Transfer Management -- [Introduction](#section11660541593) -- [Architecture](#section342962219551) -- [Available APIs](#section92711824195113) -- [Repositories Involved](#section155556361910) ## Introduction -The data classification module of OpenHarmony provides hierarchical data protection policies and related APIs. \(Currently, OpenHarmony does not provide implementations for specific APIs. These APIs must be implemented by the device vendors to protect the security of data on OpenHarmony devices.\) - -The data classification module provides the following APIs \(into two submodules\): - -- APIs for setting and obtaining the data label: With these APIs, you can set and obtain the security level of a file to be written to the disk. -- APIs for controlling cross-device data access based on the device security level: The distributed cross-device data transmission service can use these APIs to obtain the highest data security level supported by the peer device. - -The two submodules only contain API definitions, but do not implement these APIs. The following figure shows the architecture of the data classification module. - -## Architecture - -**Figure 1** Architecture of the data classification module - - -![](figures/dataclassification.png) - -## Available APIs - -**Table 1** APIs provided by the data classification module - - - - - - - - - - - - - - - - - - - - - - - - - -

API

-

Description

-

int SetLabel(int userId, const char *filePath, const char *labelName, const char *labelValue, int flag);

-

Sets a specified label. Currently, this API returns success. You need to implement this function by yourself. You are advised to set the label in the extended attribute of a file. For details about the data security levels, see the developer documentation.

-

int GetLabel(int userId, const char *filePath, const char *labelName, char *labelValue, const int valueLen);

-

Obtains the label. Currently, this API returns S3. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.

-

int GetFlag(int userId, const char *filePath, const char *labelName);

-

Obtains the flag of a data security level. Currently, this API returns FLAG_FILE_PROTECTION_COMPLETE_UNLESS_OPEN. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.

-

int32_t DEVSL_GetHighestSecLevel(DEVSLQueryParams *queryParams, uint32_t *levelInfo);

-

Obtains the highest security level supported by the peer device. Currently, this API returns S3. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.

-

int32_t DEVSL_OnStart(int32_t maxDevNum);

-

Initializes the data classification module. You need to implement this function by yourself.

-

void DEVSL_ToFinish(void);

-

Deinitializes the data classification module. You need to implement this function by yourself.

-
- -## Repositories Involved - -Security subsystem - -**base/security/dataclassification** +In OpenHarmony, the data transfer management module provides cross-device data transfer management and control policies for distributed services. The data transfer management module defines a sef of APIs to provide management and control policies for cross-device data transmission and obtain the highest risk level of data to be sent to the peer device. +The figure below illustrates the deployment logic of the data transfer management module. + +![](figures/datatransmitmgr.png) + +- Distributed service: provides distributed data management capabilities, including the distributed file system and distributed data management. + +- Data transfer management module: provides management and control policies for cross-device data transmission and obtains the highest risk level of data to be sent to the peer device. + +- Device security level management module: provides device security level information for data transfer management and control. + +Before data is transferred, the distributed service checks whether the security level of the peer device supports the risk level of the data to be transferred. The table below lists the mappings between the device security levels and data risk levels. + +**Table 1** Mappings between data risk levels and device security levels + +| **Device Security Level**| **SL5** | **SL4** | **SL3** | **SL2** | **SL1** | +| ---------------- | --------- | --------- | --------- | --------- | --------- | +| **Data Risk Level**| **S0 to S4** | **S0 to S4** | **S0 to S3** | **S0 to S2** | **S0 to S1** | + +The distributed service blocks data transmission based on the data risk level returned by the data transfer management module. Before data transmission is denied, a dialog box can be displayed to ask for user's permission. Data can be transferred if the user allows. The device vendors can implement the authorization mechanism. + + +## Directory Structure + +``` +/base/security/dataclassification +├── frameworks # Framework code +│ └── datatransmitmgr # Code of basic functions +└── interfaces # APIs + ── innerkits # Internal APIs + └── datatransmitmgr # Code of internal APIs +``` + +## Available APIs + +**Table 2** APIs of the data transfer management module + +| API | Description | +| ------------------------------------------------------------ | -------------------------------------- | +| int32_t DATASL_GetHighestSecLevel(DEVSLQueryParams *queryParams, uint32_t *levelInfo); | Obtains the data risk levels supported by the device. | +| int32_t DATASL_GetHighestSecLevelAsync(DEVSLQueryParams *queryParams, HigestSecInfoCallback *callback); | Asynchronously obtains the data risk levels supported by the device.| +| int32_t DATASL_OnStart(void); | Starts initialization. | +| void DATASL_OnStop(void); | Stops initialization. | + + + + +## Repositories Involved + +**Security subsystem** + +base/security/dataclassification diff --git a/figures/datatransmitmgr.png b/figures/datatransmitmgr.png new file mode 100644 index 0000000000000000000000000000000000000000..251706728997938992fde7552dfdd1edc561280d Binary files /dev/null and b/figures/datatransmitmgr.png differ