Engineering building BIM data safety management method

Abstract

The invention relates to the field of engineering building data management, and discloses an engineering building BIM data security management method, which comprises the following steps: step 1, user identity is verified through multi-factor identity authentication, and the multi-factor identity authentication comprises user name password authentication, dynamic password authentication and biological recognition authentication; 2, performing dynamic identity verification based on behavior data of the user, wherein the behavior data comprises an operation path, a time characteristic, an equipment fingerprint and a geographic position of the user; 3, according to the role and task state of the user in the BIM project, dynamically allocating access authority; and 4, predicting the authority demand of the user in the future task stage through an AI algorithm, and automatically adjusting the authority. Through combination of multi-factor identity authentication and user behavior analysis, dynamic verification of the user identity is realized, the authority demand of the future task stage is predicted through the AI model, and the flexibility and accuracy of authority management are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of engineering construction data management, and in particular to a method for secure management of engineering construction BIM data. Background Art

[0002] With the rapid development of the engineering construction industry, Building Information Modeling (BIM) technology has been widely used in engineering projects. BIM technology integrates various types of information of construction projects in a digital way, covering the entire life cycle management from design, construction to operation and maintenance. Its core lies in creating a highly collaborative three-dimensional digital model, which not only contains geometric information, but also various information such as physical properties, costs, and time schedule, which can effectively improve project collaboration efficiency and engineering quality. The use of BIM technology enables all parties involved in the project to share unified engineering data and achieve efficient collaboration and management, thereby shortening the project cycle, reducing costs and reducing construction errors. However, with the popularization of BIM technology and the expansion of the scale of engineering projects, the frequent transmission and operation of massive engineering data between parties has also brought huge challenges to data security and authority management.

[0003] When facing multi-party collaboration and complex engineering environments, existing BIM data management systems often rely on traditional static permission control methods, that is, determining the user's operating scope through pre-set role permission configuration. This traditional permission management method has the following shortcomings: Due to the dynamic nature of construction projects, user roles and tasks will change frequently at different project stages. Static permission management is difficult to adapt to real-time changes in tasks and roles, which can easily lead to permission abuse or unnecessary high-privilege legacy.

[0004] Access control over data in existing systems lacks sufficient granularity, especially when sensitive data is involved. It is impossible to make fine-grained adjustments to permissions based on data sensitivity and operating environment (such as network security, geographic location, and device type), increasing the risk of data leakage. Third, existing identity authentication mechanisms are mostly single username and password authentication, which are vulnerable to network attacks or credential leakage. Especially when multiple users need to access highly sensitive information, a single authentication method is difficult to provide sufficient security. In addition, the existing system lacks intelligent permission prediction and dynamic adjustment mechanisms, resulting in more manual intervention in permission management, which is inefficient and error-prone.

[0005] Therefore, in order to effectively solve the existing technology, a method for security management of engineering construction BIM data is provided. Summary of the invention

[0006] In view of the deficiencies of the prior art, the present invention provides a method for secure management of engineering construction BIM data, which solves the problem that due to the dynamic nature of construction projects, user roles and tasks frequently change in different project stages, and static permission management is difficult to adapt to real-time changes in tasks and roles.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for secure management of engineering construction BIM data, comprising the following steps:

[0008] Step 1: Verify the user's identity through multi-factor authentication, which includes username and password authentication, dynamic password authentication, and biometric authentication;

[0009] Step 2: Dynamic identity authentication based on the user's behavior data, which includes the user's operation path, time characteristics, device fingerprint and geographic location;

[0010] Step 3: Dynamically assign access rights based on the user’s role and task status in the BI M project;

[0011] Step 4: Use AI algorithms to predict the user's permission requirements for future tasks and automatically adjust permissions;

[0012] Step 5: Perform fine-grained permission control based on the sensitivity of BIM data and the user operation environment;

[0013] Step 6: Monitor users’ operations on BIM data in real time, and perform abnormal operation detection and auditing.

[0014] Preferably, the multi-factor identity authentication specifically includes the following steps:

[0015] The user performs initial authentication via a password;

[0016] The system generates and sends a dynamic password through a time-based one-time password TOTP, and the user enters the password to complete the verification;

[0017] When high permissions or access to sensitive data are required, the system requires users to confirm their identity through biometric technology.

[0018] Preferably, the dynamic identity authentication based on user behavior data comprises the following steps:

[0019] The system collects user operation behavior data in real time, including clicks, operation paths, device fingerprints and geographic locations;

[0020] The system builds a behavioral baseline model based on the user's historical behavior data;

[0021] The system compares current operations with historical behaviors through anomaly detection algorithms. If deviations are found, the system triggers further identity authentication or locks the user account.

[0022] Preferably, the dynamically allocating access rights according to user roles and task status specifically includes the following steps:

[0023] The system obtains the user’s role and current task status in the BI M project;

[0024] The system determines the corresponding set of access permissions based on the task status and role;

[0025] When a task is completed or enters a new stage, the system automatically revokes or adjusts the permissions related to the task.

[0026] Preferably, the step of predicting the user's future task stage authority requirements through an AI algorithm includes:

[0027] The system extracts characteristic data such as task status, role, and operation frequency based on the user's historical operation data;

[0028] Use machine learning algorithms to train models to predict user permission requirements in future task phases;

[0029] Based on the model prediction results, the system assigns necessary permissions to users in advance to reduce manual configuration.

[0030] Preferably, the fine-grained permission control based on the sensitivity of BIM data and the user operating environment includes:

[0031] The system divides the data into normal data, sensitive data and highly sensitive data according to the sensitivity level of BIM data;

[0032] The system dynamically adjusts the user's access rights to data of different sensitivity levels based on the user's role, task status, and current operating environment (including geographic location, network environment, and device type).

[0033] Preferably, the real-time monitoring of user operation behavior and abnormal operation detection includes:

[0034] The system records the user's operation behavior in real time, collecting data such as operation time, device, IP address, operation path, etc.

[0035] The system analyzes user behavior and detects potential abnormal operations through the time series-based anomaly detection algorithm LSTM-AD;

[0036] Once abnormal behavior is detected, the system automatically triggers a response mechanism, including temporarily locking user permissions or issuing a warning to notify the administrator.

[0037] Preferably, the authority audit includes the following steps:

[0038] The system records each permission granting, modification, and revocation operation of the user, and logs the user's permission usage behavior;

[0039] The system regularly generates permission usage audit reports, which administrators use to perform permission backtracking and violation analysis.

[0040] Preferably, the permission control based on the user operating environment also includes:

[0041] The system determines whether the user is accessing sensitive data in a trusted environment by monitoring the user's operating environment, including their device type, geographic location, and network environment;

[0042] If a user attempts to access highly sensitive data in an unsecured environment, the system automatically restricts the user's access to the data.

[0043] A BIM data security management system for engineering buildings, the system comprising:

[0044] An identity authentication unit, used to verify the user's identity through multi-factor authentication;

[0045] Behavior analysis unit, used to collect and analyze user operation behavior data and perform dynamic identity authentication;

[0046] The permission management unit is used to dynamically assign access rights based on user roles and task status, and optimize permission configuration based on AI models;

[0047] Fine-grained control unit for performing permission control based on data sensitivity and user operating environment;

[0048] The monitoring and auditing unit is used to monitor user operation behavior in real time and generate audit reports.

[0049] The present invention provides a method for secure management of BIM data in engineering construction, which has the following beneficial effects:

[0050] 1. The present invention realizes dynamic verification of user identity through multi-factor identity authentication combined with user behavior analysis, and predicts the permission requirements of future task stages through AI models, which greatly improves the flexibility and accuracy of permission management, ensures that users always have the minimum permissions that match their work requirements in different tasks and roles, and reduces the complexity of manual intervention.

[0051] 2. Based on the sensitivity of BIM data and multi-dimensional monitoring of the user's operating environment, the system can adjust access rights in real time to ensure secure access to data at different sensitivity levels and in different environments, comprehensively improve the level of refinement of data protection, and prevent the risk of abuse of rights and data leakage.

[0052] 3. Through real-time monitoring and anomaly detection of user operation behaviors, combined with detailed permission use audit reports, the system can effectively prevent unauthorized operations and provide comprehensive permission use traceability, ensure operational transparency and compliance during system operation, and significantly improve the overall security and management efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a flow chart of the method of the present invention;

[0054] Figure 2 It is a system framework diagram of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Embodiment 1:

[0057] Please see attached Figure 1 - Attachment Figure 2 The embodiment of the present invention provides a method for secure management of engineering construction BIM data, comprising the following steps:

[0058] Step 1: Verify the user's identity through multi-factor authentication, which includes username and password authentication, dynamic password authentication, and biometric authentication;

[0059] Step 2: Dynamic identity authentication based on the user's behavior data, which includes the user's operation path, time characteristics, device fingerprint and geographic location;

[0060] Step 3: Dynamically assign access rights based on the user’s role and task status in the BI M project;

[0061] Step 4: Use AI algorithms to predict the user's permission requirements for future tasks and automatically adjust permissions;

[0062] Step 5: Implement fine-grained permission control based on the sensitivity of BIM data and the user operating environment;

[0063] Step 6: Monitor users’ operations on BIM data in real time, and detect and audit abnormal operations.

[0064] The multi-factor identity authentication specifically includes the following steps:

[0065] The user performs initial authentication via a password;

[0066] The system generates and sends a dynamic password through a time-based one-time password TOTP, and the user enters the password to complete the verification;

[0067] When high permissions or access to sensitive data are required, the system requires users to confirm their identity through biometric technology.

[0068] Specifically, the user performs preliminary identity authentication by entering a password, and the system performs salt-based hashing on the password to enhance anti-cracking capabilities. Subsequently, the system generates a time-based dynamic one-time password (TOTP) and sends the dynamic password to the user's trusted device (such as a mobile phone, email, or identity authentication application) through a secure channel. The user needs to enter the dynamic password within a limited time to complete the second layer of verification, thereby ensuring the timeliness and uniqueness of the authentication process. When it comes to high-privilege operations or access to sensitive data, the system further requires the user to confirm his identity through biometric technology, such as fingerprints, facial recognition, or iris scanning. The biometric data is only encrypted and processed locally on the user's device, and the authentication is completed through the FIDO2 / WebAuthn protocol, thereby ensuring that the security level of authentication is improved without leaking biometric information. Through this multi-level identity authentication process, the system effectively reduces the security risks brought by a single identity authentication method and ensures the reliability and security of sensitive operations.

[0069] The dynamic identity authentication based on user behavior data includes the following steps:

[0070] The system collects user operation behavior data in real time, including clicks, operation paths, device fingerprints and geographic locations;

[0071] The system builds a behavioral baseline model based on the user's historical behavior data;

[0072] The system compares current operations with historical behaviors through anomaly detection algorithms. If deviations are found, the system triggers further identity authentication or locks the user account.

[0073] Specifically, the system collects user operation behavior data in real time, covering multi-dimensional information such as click behavior, operation path, device fingerprint, geographic location, session duration, etc., to fully capture the user's interaction pattern in the system. Based on these real-time collected data, the system uses historical operation records to establish a user-specific behavior baseline model. The model accurately reflects the user's typical behavior pattern by analyzing factors such as the user's regular operation habits, device usage frequency, and geographic location preferences. Next, the system uses advanced anomaly detection algorithms (such as machine learning models or statistical analysis) to dynamically compare the current operation behavior with the baseline model, analyze whether the current behavior is consistent with the user's historical behavior, and determine whether there is a potential security risk.

[0074] The method of dynamically allocating access rights according to user roles and task status specifically includes the following steps:

[0075] The system obtains the user’s role and current task status in the BIM project;

[0076] The system determines the corresponding set of access permissions based on the task status and role;

[0077] When a task is completed or enters a new stage, the system automatically revokes or adjusts the permissions related to the task.

[0078] Specifically, the system obtains the user's role information in the BIM project and the execution status of his current task in real time. This role information may include various types such as project manager, designer, and construction personnel. At the same time, the task status covers specific project progress such as the design stage, construction stage, and review stage. Based on the user's role and task status, the system intelligently matches and determines the user's access permission set in the current project stage through a preset permission policy library, ensuring that the user can only access BIM data and functional modules related to his current responsibilities, thereby strictly following the principle of least privilege.

[0079] The step of predicting the user's future task stage authority requirements through the AI ​​algorithm includes:

[0080] The system extracts characteristic data such as task status, role, and operation frequency based on the user's historical operation data;

[0081] Use machine learning algorithms to train models to predict user permission requirements in future task phases;

[0082] Based on the model prediction results, the system assigns necessary permissions to users in advance to reduce manual configuration.

[0083] Specifically, based on the user's historical operation data in the BIM project, the feature information related to permissions is fully extracted. This information not only includes the user's role type and current task status, but also covers behavioral characteristics such as operation frequency, access period, and data interaction depth. The user's operation profile is constructed through multi-dimensional data features. Then, the system uses these historical data and advanced machine learning algorithms (such as random forests, gradient boosting trees, etc.) to train and model permission requirements to predict the set of permissions that users may need in future task stages. The model automatically determines the user's permission requirements in subsequent project stages by analyzing the user's permission usage patterns and role changes in similar task scenarios, and adaptively adjusts the model parameters during the prediction process to improve prediction accuracy.

[0084] The fine-grained permission control based on the sensitivity of BIM data and the user operating environment includes:

[0085] The system divides the data into ordinary data, sensitive data and highly sensitive data according to the sensitivity level of BIM data;

[0086] The system dynamically adjusts the user's access rights to data of different sensitivity levels based on the user's role, task status, and current operating environment (including geographic location, network environment, and device type).

[0087] Specifically, the fine-grained permission control based on the sensitivity of BIM data and the user operating environment includes the following steps: First, the system classifies the BIM data according to its sensitivity level, and divides the data into ordinary data, sensitive data, and highly sensitive data. Ordinary data usually includes general design information and non-critical files in the project, sensitive data may involve key design details and construction plans of the building, and highly sensitive data includes security system configuration, financial information, or files involving privacy and legal compliance. The system formulates corresponding access control rules for different categories of data based on the preset security policy, and tags each category of data with permissions.

[0088] The real-time monitoring of user operation behavior and abnormal operation detection includes:

[0089] The system records the user's operation behavior in real time, collecting data such as operation time, device, IP address, operation path, etc.

[0090] The system analyzes user behavior and detects potential abnormal operations through the time series-based anomaly detection algorithm LSTM-AD;

[0091] Once abnormal behavior is detected, the system automatically triggers a response mechanism, including temporarily locking user permissions or issuing a warning to notify the administrator.

[0092] The permission audit includes the following steps:

[0093] The system records each permission granting, modification, and revocation operation of the user, and logs the user's permission usage behavior;

[0094] The system regularly generates permission usage audit reports, which administrators use to perform permission backtracking and violation analysis.

[0095] The permission control based on the user operating environment also includes:

[0096] The system determines whether the user is accessing sensitive data in a trusted environment by monitoring the user's operating environment, including their device type, geographic location, and network environment;

[0097] If a user attempts to access highly sensitive data in an unsecured environment, the system automatically restricts the user's access to the data.

[0098] Embodiment 2:

[0099] A BIM data security management system for engineering buildings, the system comprising:

[0100] An identity authentication unit, used to verify the user's identity through multi-factor authentication;

[0101] Behavior analysis unit, used to collect and analyze user operation behavior data and perform dynamic identity authentication;

[0102] The permission management unit is used to dynamically assign access rights based on user roles and task status, and optimize permission configuration based on AI models;

[0103] Fine-grained control unit for performing permission control based on data sensitivity and user operating environment;

[0104] The monitoring and auditing unit is used to monitor user operation behavior in real time and generate audit reports.

[0105] Specifically, first, the identity authentication unit is responsible for multi-level verification of user identity, using a multi-factor authentication mechanism, including username and password verification, dynamic one-time password (TOTP) verification, and biometrics such as fingerprint or facial recognition, to ensure the authenticity of user identity and the security of operation. Secondly, the behavior analysis unit collects user operation behavior data in real time, including user click behavior, operation path, device fingerprint and geographic location, etc., uses historical behavior data to establish a user behavior baseline model, and ensures the legitimacy of user operations through dynamic identity authentication. If abnormal behavior is detected, the system will trigger further verification or restrict user operation permissions. The permission management unit dynamically allocates access rights that match the user's current work needs based on the user's role and task status in the BIM project, and the unit predicts permission requirements through AI models, optimizes permission configuration for users in advance, reduces manual intervention, and ensures the rationality and timeliness of permission allocation. The fine-grained control unit performs precise permission control based on the sensitivity of BIM data and the user's operating environment (such as geographic location, network security, and device type), dynamically adjusts the user's access rights to data at different levels, and ensures the protection of data under different security conditions. Finally, the monitoring and auditing unit is used to monitor the user's operation behavior in real time. The system will generate detailed audit logs and regularly output audit reports. Administrators can use audit tools to trace the use of permissions, analyze potential abuse of permissions or abnormal behavior, and ensure the operational security and compliance of the entire BI M system.

[0106] Embodiment three:

[0107] Step 1: Multi-factor authentication

[0108] 1.1 Preliminary Identity Verification

[0109] Receive the username and password entered by the user, verify the password using an algorithm based on salt encryption (such as PBKDF2 or Argon2), and preliminarily confirm the user's identity.

[0110] 1.2 Dynamic Authentication

[0111] Using a time-based one-time password (TOTP), the system generates a dynamic password and sends it to the user through an authentication app on the user's device, SMS or email, requiring the user to enter the dynamic password to complete further verification.

[0112] 1.3 Biometric Authentication

[0113] When it comes to sensitive operations or high-privilege access, the system requires users to perform additional authentication through the biometric features on the device (such as fingerprint recognition, facial recognition). Biometric information uses the FIDO2 standard and is encrypted only on the local device.

[0114] 1.4 Equipment and environment verification

[0115] The system detects the uniqueness of the user's device (such as device fingerprint) and the security of the operating environment (such as geographic location and whether a secure network connection is used). If there are any abnormalities in the device or environment, additional authentication steps are triggered.

[0116] Step 2: Dynamic Authentication Based on Behavior Analysis

[0117] 2.1 Behavioral Data Collection

[0118] The system records user behavior data, including operational behaviors (such as clicks, mouse movements, data access paths, etc.), time characteristics, geographic locations, device fingerprints, etc.

[0119] 2.2 Establishing a baseline model of user behavior

[0120] Cluster analysis of users’ historical operation behaviors is performed through machine learning algorithms (such as K-Means or LSTM) to generate a user’s behavior baseline model and form the characteristics of normal operation modes.

[0121] 2.3 Real-time behavior analysis and anomaly detection

[0122] The user's current operation is compared with the behavior baseline model in real time to calculate the deviation value of the operation behavior. When an abnormal operation is detected (such as abnormal login in geographical location, obvious inconsistency between operation behavior and historical records), the system triggers the abnormal response mechanism.

[0123] 2.4 Abnormal response mechanism

[0124] If abnormal behavior is detected, the system automatically restricts the user's operating permissions, requires the user to re-authenticate (such as re-entering a dynamic password or biometrics), or issues a warning to notify the administrator.

[0125] Step 3: Dynamic permission management based on roles and tasks

[0126] 3.1 Role Identification and Authority Allocation

[0127] The system automatically matches and assigns corresponding access rights based on the user's role in the BIM project (such as designer, construction worker, project manager) and task status (such as design phase, construction phase).

[0128] 3.2 Task-driven permission adjustment

[0129] The system dynamically adjusts user permissions based on the progress of project tasks. When a task is completed or transitioned to a new stage, the system automatically adds or revokes permissions related to the task to ensure the principle of minimizing permissions.

[0130] 3.3 Time Limits and Dynamic Permissions

[0131] For access to sensitive data, the system can set time limits, and certain permissions are only valid during a specific time period or task. If the time period is exceeded, the permission will be automatically revoked.

[0132] Step 4: AI-based permission prediction and optimization

[0133] 4.1 Analysis of Historical Permission Usage

[0134] The system analyzes the user's permission usage behavior in historical tasks and extracts feature data (such as task stage, role, operation frequency, etc.) as the input of the permission prediction model.

[0135] 4.2 AI model training and permission prediction

[0136] By using supervised learning algorithms such as random forest to train AI models, the system predicts the permissions that users may need in future task stages and assigns corresponding permissions to them in advance, optimizing the permission management process.

[0137] Random Forest Algorithm:

[0138] Random forests classify or regress feature sets by constructing multiple decision trees. The formula is: 1. During the training process, the prediction result of the jth decision tree is:

[0139]

[0140] Among them, T j (X) is the prediction result of the jth tree for the input feature set X, w ji is feature x i The weight f in the jth tree j (x i ) is the decision tree on feature x i 2. The final random forest model output is the weighted average of the prediction results of all trees:

[0141]

[0142] Where m is the total number of decision trees, is the final prediction result of the model for the feature set X, that is, the permission requirements for the future task stage.

[0143] 4.3 Dynamic Permission Optimization and Feedback

[0144] The system adjusts and optimizes permission configuration in real time based on actual usage, and continuously improves the prediction effect of the AI ​​model through reinforcement learning to ensure that users always have the most reasonable set of permissions.

[0145] Step 5: Fine-grained permission control

[0146] 5.1 Data classification and labeling

[0147] The system manages BIM data in a hierarchical manner based on its sensitivity, classifying the data into ordinary data, sensitive data and highly sensitive data, and labels each data object.

[0148] 5.2 Refined Operation Permission Control

[0149] For different types of data, the system finely controls the user's operating permissions to ensure that users can only perform operations related to their tasks and roles (such as viewing, editing, exporting, printing, etc.).

[0150] 5.3 Scenario-based Dynamic Permission Control

[0151] The system dynamically adjusts user permissions based on the user's operating environment (such as device type, geographic location, network environment, etc.). For example, users can only access highly sensitive data in a secure network environment.

[0152] Step 6: Real-time monitoring and auditing

[0153] 6.1 Operation behavior monitoring and logging

[0154] The system records all user operations on BIM data in real time, including data access, modification, export, etc., and records characteristics such as operation time, equipment information, and network environment.

[0155] 6.2 Abnormal Operation Detection and Automatic Response

[0156] Through anomaly detection algorithms (such as Isolation Forest and LSTM-AD), the system analyzes user operation behaviors in real time to detect potential abuse of permissions or abnormal operations. If abnormal behavior is found, the system automatically responds according to the risk level and may temporarily lock user permissions or notify the administrator.

[0157] 6.3 Permission Usage Audit and Report Generation

[0158] The system regularly generates permission usage audit reports to record user permission granting, usage, modification, revocation, etc. Administrators can use the reports to analyze permission usage, identify illegal operations, and make subsequent permission adjustments.

[0159] Overall process summary

[0160] After the user verifies his / her identity through the multi-factor authentication module, the system performs dynamic identity authentication based on the user's behavior data to ensure that the user's behavior during the operation meets security requirements.

[0161] After the user's identity is confirmed, the system dynamically predicts and allocates permissions based on the user's role and task status through an AI model, and continuously adjusts permissions to adapt to task progress.

[0162] The system finely controls user permissions based on the sensitivity of BIM data and the user's operating scenarios to ensure the principle of least privilege. At the same time, it ensures the traceability of operating behaviors through real-time monitoring and log recording.

[0163] The system uses anomaly detection and permission auditing functions to promptly detect and prevent permission abuse, ensuring the security and compliance of BIM data.

[0164] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for secure management of BIM data for engineering construction, characterized in that: The following steps are involved: Step 1: Verify the user's identity through multi-factor authentication, which includes username and password authentication, dynamic password authentication, and biometric authentication; Step 2: Dynamic identity authentication based on the user's behavior data, which includes the user's operation path, time characteristics, device fingerprint and geographic location; Step 3: Dynamically assign access rights based on the user’s role and task status in the BIM project; Step 4: Use AI algorithms to predict the user's permission requirements for future tasks and automatically adjust permissions; Step 5: Perform fine-grained permission control based on the sensitivity of BIM data and the user operating environment; Step 6: Monitor users’ operations on BIM data in real time, and detect and audit abnormal operations.

2. A method for secure management of BIM data for construction projects according to claim 1, characterized in that: The multi-factor identity authentication specifically includes the following steps: The user performs initial authentication via a password; The system generates and sends a dynamic password through a time-based one-time password TOTP, and the user enters the password to complete the verification; When high permissions or access to sensitive data are required, the system requires users to confirm their identity through biometric technology.

3. A method for secure management of BIM data for engineering construction according to claim 1, characterized in that: The dynamic identity authentication based on user behavior data includes the following steps: The system collects user operation behavior data in real time, including clicks, operation paths, device fingerprints and geographic locations; The system builds a behavioral baseline model based on the user's historical behavior data; The system compares current operations with historical behaviors through anomaly detection algorithms. If deviations are found, the system triggers further identity authentication or locks the user account.

4. A method for secure management of BIM data for construction projects according to claim 1, characterized in that: The method of dynamically allocating access rights according to user roles and task status specifically includes the following steps: The system obtains the user’s role and current task status in the BIM project; The system determines the corresponding set of access permissions based on the task status and role; When a task is completed or enters a new stage, the system automatically revokes or adjusts the permissions related to the task.

5. The method for secure management of BIM data for engineering construction according to claim 1, characterized in that: The step of predicting the user's future task stage authority requirements through the AI ​​algorithm includes: The system extracts characteristic data such as task status, role, and operation frequency based on the user's historical operation data; Use machine learning algorithms to train models to predict user permission requirements in future task phases; Based on the model prediction results, the system assigns necessary permissions to users in advance to reduce manual configuration.

6. A method for secure management of BIM data for construction projects according to claim 1, characterized in that: The fine-grained permission control based on the sensitivity of BIM data and the user operating environment includes: The system divides the data into ordinary data, sensitive data and highly sensitive data according to the sensitivity level of BIM data; The system dynamically adjusts the user's access rights to data of different sensitivity levels based on the user's role, task status, and current operating environment (including geographic location, network environment, and device type).

7. A method for secure management of BIM data for construction projects according to claim 1, characterized in that: The real-time monitoring of user operation behavior and abnormal operation detection includes: The system records the user's operation behavior in real time, collecting data such as operation time, device, IP address, operation path, etc. The system analyzes user behavior and detects potential abnormal operations through the time series-based anomaly detection algorithm LSTM-AD; Once abnormal behavior is detected, the system automatically triggers a response mechanism, including temporarily locking user permissions or issuing a warning to notify the administrator.

8. The method for secure management of BIM data for construction engineering according to claim 1, characterized in that: The permission audit includes the following steps: The system records each permission granting, modification, and revocation operation of the user, and logs the user's permission usage behavior; The system regularly generates permission usage audit reports, which administrators use to perform permission backtracking and violation analysis.

9. The method for secure management of BIM data for engineering construction according to claim 1, characterized in that: The permission control based on the user operating environment also includes: The system determines whether the user is accessing sensitive data in a trusted environment by monitoring the user's operating environment, including their device type, geographic location, and network environment; If a user attempts to access highly sensitive data in an unsecured environment, the system automatically restricts the user's access to the data.

10. A BIM data security management system for engineering and construction, according to the BIM data security management method for engineering and construction according to claims 1-9, characterized in that: The system includes: An identity authentication unit, used to verify the user's identity through multi-factor authentication; Behavior analysis unit, used to collect and analyze user operation behavior data and perform dynamic identity authentication; The permission management unit is used to dynamically assign access rights based on user roles and task status, and optimize permission configuration based on AI models; Fine-grained control unit for performing permission control based on data sensitivity and user operating environment; The monitoring and auditing unit is used to monitor user operation behavior in real time and generate audit reports.

Images