Security protection method and system for information management system and storage medium

Abstract

The invention discloses a security protection method and system for an information management system and a storage medium, and relates to the technical field of security protection.During operation of the system, when a user logs in or carries out sensitive operation, multiple identity verifications are carried out, an identity verification coefficient AC is obtained through calculation, various security parameters in the system are collected and updated in real time, and the security protection efficiency is improved. A high-strength encryption algorithm is applied to data to be transmitted, an encrypted data packet is generated, a transmission encryption coefficient EC is obtained through calculation, corresponding access permissions are set for different data based on user roles, identities and access content, an abnormal monitoring coefficient ADC is obtained, and a comprehensive safety coefficient SEC is obtained through calculation according to an identity verification coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC. The overall safety of the system is dynamically evaluated, abnormal behaviors are recognized and logs are recorded by comparing the comprehensive safety coefficient SEC with a preset threshold value, and when the system detects an abnormal access mode, a safety alarm is triggered and countermeasures are taken.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and in particular to a security protection method, system and storage medium for an information management system. Background Art

[0002] Information management systems used in retail and e-commerce usually involve the storage and transmission of a large amount of sensitive data, such as user personal information, payment information, transaction records, etc. The protection of this information is crucial to ensure user privacy and transaction security. However, with the continuous escalation of network attack methods, the security threats faced by information management systems are also increasing. Criminals can cause damage to the system by stealing data, tampering with transactions, etc. Therefore, how to establish a complete information management system security protection mechanism for retail and e-commerce platforms to ensure data integrity, confidentiality and availability has become an important research topic in the field of information management.

[0003] However, traditional security protection methods have some shortcomings, such as a single identity authentication method, insufficient encryption strength during data transmission, an imperfect authority management system, and insufficient abnormal monitoring capabilities. These defects can easily lead to loopholes in the security protection of information management systems, making the system easy to break through when facing malicious attacks or operations. In the absence of perfect security protection, information management systems may face a variety of security risks, such as user data being stolen, transaction records being tampered with, and the system being attacked by malicious attacks. Especially in the field of retail and e-commerce, once a security vulnerability occurs in the system, the user's privacy data and transaction data are extremely vulnerable to attacks by criminals. These attacks may lead to the theft of user accounts, loss of transaction funds, and even damage to the company's brand reputation. In addition, once a security incident occurs, system data may be difficult to recover, which in turn affects the company's business continuity. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a security protection method, system and storage medium for an information management system, which solves the problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a security protection system for an information management system, comprising a user identity authentication module, a data acquisition module, a data encryption module, an access control module, an abnormality monitoring module and a data backup module; The user identity authentication module is used to perform multiple identity authentication when the user logs in or performs sensitive operations, and verifies the user's identity through passwords, biometrics and verification codes to form a verification data group, which is pre-processed and calculated to obtain: identity authentication coefficient AC; The data acquisition module is used to collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, and summarize and store the collected parameter data in the system database; The data encryption module is used to encrypt all sensitive data during data transmission. Before data transmission, a high-intensity encryption algorithm is applied to the data to be transmitted to generate an encrypted data packet. After pre-processing, the transmission encryption coefficient EC is calculated and obtained; The access control module is used to perform hierarchical authority management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, corresponding access rights are set for different data, and corresponding resource access rights are allocated to prevent users from exceeding their authority scope and unauthorized access behavior; The abnormal monitoring module is used to monitor user behavior and system operation, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC according to the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC, dynamically evaluate the overall security of the system, identify abnormal behavior and record logs by comparing the comprehensive security coefficient SEC with the preset threshold, and trigger a security alarm and take countermeasures when the system detects an abnormal access mode; The data backup module is used to regularly back up key system data and quickly restore data when data is damaged or lost, establish offline backup and cloud backup mechanisms, and ensure data security.

[0006] Preferably, the user identity authentication module includes an identity authentication unit and an identity authentication coefficient calculation unit; The identity verification unit is used to perform multiple identity verification when the user logs in or performs sensitive operations by receiving login credentials input by the user, combining password verification, one-time verification code and biometrics, and biometrics include fingerprint recognition and face recognition, so that only legitimate users can access the system; The identity authentication coefficient calculation unit is used to extract the multi-factor identity authentication success rate MFAR from the log of the identity authentication system, obtain the identity authentication strength value ATS by combining the character type and password length with the fingerprint or facial recognition matching degree, count the number of successful authentications of each user in a unit time through log records, obtain: the number of successful user identity authentications VID, form a verification data group, standardize and clean the verification data group, and obtain: the identity authentication coefficient AC after calculation; The identity verification coefficient AC is calculated by the following formula: ; In the formula, MFAR represents the multi-factor authentication success rate, ATS represents the authentication strength value, and VID represents the number of successful user authentication. They respectively represent the weight coefficients of the multi-factor authentication success rate MFAR, the authentication strength value ATS, and the number of successful user authentication times VID.

[0007] Preferably, the data acquisition module includes a data collection unit and a parameter summary unit; The data collection unit is used to collect the user's operation behavior data and various security parameters in the system in real time, including key length and encryption algorithm strength; The parameter summary unit is used to integrate and classify the collected multiple types of parameter data, and store them in the system database, and continuously update the system security parameters according to the real-time operating environment.

[0008] Preferably, the data encryption module includes an encryption algorithm application unit and a transmission encryption coefficient calculation unit; The encryption algorithm application unit is used to encrypt and transmit user sensitive information and transaction data using the SSL / TLS protocol and asymmetric encryption method to prevent data from being intercepted or tampered with during transmission, obtain the encryption algorithm strength AES according to the encryption algorithm, and obtain the key length Key in the system configuration or data encryption module. Len , read the currently used transmission protocol type through the network communication module or data encryption module, and obtain the transmission protocol security Prot Sec ; The transmission encryption coefficient calculation unit is used to format and package the encrypted data packet, calculate and generate the transmission encryption coefficient EC; The transmission encryption coefficient EC is calculated by the following formula: ; In the formula, AES represents the strength of the encryption algorithm, Key Len Indicates the key length, Prot Sec Indicates the security of the transmission protocol. Respectively represent the encryption algorithm strength AES and key length Key Len and Transport Protocol Security Prot Sec The weight coefficient of .

[0009] Preferably, the access control module includes a role identification unit, a permission allocation unit and a permission monitoring unit; The role identification unit is used to identify the role information of the user. According to the user's login information, the system confirms the role type of the user's identity through preset role categories, including ordinary users, VIP users and administrators. By identifying the role category, the user's authority level is determined to ensure that users with different roles have different access rights; The permission allocation unit is used to allocate corresponding resource access rights to users according to their roles. Users can only access data and resources that match their role permissions, thereby preventing unauthorized data access. Ordinary users can only view and edit their personal information, VIP users can access more functions, and administrators have full control permissions; The permission monitoring unit is used to monitor the user's operating behavior in real time to ensure that the user performs operations within the scope of authority. Once it is detected that the user has unauthorized access behavior or attempts to access unauthorized resources, the permission monitoring unit immediately records the event and takes corresponding measures including warnings or blocking access.

[0010] Preferably, the abnormality monitoring module includes an abnormality detection unit, a log recording unit and an alarm response unit; The anomaly detection unit is used to monitor the system operation and user behavior in real time, calculate the detection frequency per unit time in real time in the anomaly monitoring module, obtain: detection frequency DET, obtain the log record integrity ratio LTR through log records, obtain the anomaly detection accuracy ADT through analysis of the detection results, identify potential abnormal situations, including frequent login failures and abnormal data access requests, use set rules or algorithms to detect abnormal patterns, obtain the anomaly monitoring coefficient ADC after calculation, and make a preliminary judgment based on the type and frequency of the anomaly, and calculate and obtain: comprehensive security factor SEC through identity authentication coefficient AC, transmission encryption coefficient EC and anomaly monitoring coefficient ADC; The abnormal monitoring coefficient ADC is calculated by the following formula: ; In the formula, DET represents the detection frequency, LTR represents the log record completeness ratio, and ADT represents the anomaly detection accuracy. They represent the weight coefficients of detection frequency DET, log record completeness ratio LTR and anomaly detection accuracy ADT respectively; The log recording unit is used to record all operation logs related to system security, including normal operations and detected abnormal behaviors, and the recorded content includes operation time, user information, access resources, operation type and abnormal mark; The alarm response unit is used to send out corresponding alarms and take corresponding measures according to the severity of the abnormality after the abnormality detection unit identifies abnormal behavior, including sending notifications or temporarily locking the account.

[0011] Preferably, the comprehensive safety factor SEC is calculated by the following formula: ; In the formula, AC represents the authentication coefficient, EC represents the transmission encryption coefficient, and ADC represents the abnormal monitoring coefficient. They represent the weight coefficients of the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC respectively; By comparing the comprehensive safety factor SEC with the preset safety threshold A and the preset safety threshold B, a three-level threshold comparison evaluation strategy is obtained: When the comprehensive safety factor SEC ≥ the preset safety threshold B, the system is in a safe state and there are no safety hazards. Regularly check the system configuration to ensure that the settings of identity authentication, data encryption and abnormal monitoring modules meet safety standards and maintain the current operating status and monitoring frequency of safety measures; When the preset security threshold A≤comprehensive security factor SEC<preset security threshold B, the system is at risk. The multi-factor authentication strength of identity authentication should be increased, verification codes should be added or more complex biometric authentication should be enabled, the authentication factor AC should be increased, and the key length should be increased or a higher strength encryption algorithm should be switched according to the system resources. When the comprehensive security factor SEC is less than the preset security threshold A, multi-factor authentication combining passwords, biometrics and hardware security keys is immediately enabled, external access traffic to the system is restricted, and 24-hour real-time monitoring and log analysis are started.

[0012] Preferably, the data backup module includes a periodic backup unit and a backup storage unit; The periodic backup unit is used to back up key data in the system at preset time intervals to ensure that data can be restored in the event of emergencies, including hardware failure or data corruption. When data corruption or loss is detected, the data is restored from the most recent backup to quickly restore the data to the most recent backup state, thereby shortening the system interruption time due to data loss or corruption; The backup storage unit is used to safely store the backup data on different physical or cloud storage media, including offline disks or cloud storage.

[0013] Preferably, the method comprises the following steps: Step 1: Perform multiple authentication when the user logs in or performs sensitive operations. Verify the user's identity through password, biometrics and verification code to form a verification data group. After preprocessing, calculate the authentication coefficient AC; Step 2: Collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, summarize and store the collected parameter data in the system database; Step 3: Encrypt all sensitive data during data transmission. Before data transmission, apply a high-intensity encryption algorithm to the data to be transmitted to generate an encrypted data packet. After preprocessing, calculate and obtain the transmission encryption coefficient EC; Step 4: Perform hierarchical permission management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, set corresponding access rights for different data and assign corresponding resource access rights to prevent users from exceeding their authority. Step 5: Monitor user behavior and system operations, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC based on the identity authentication coefficient AC, transmission encryption coefficient EC and abnormal monitoring coefficient ADC. Dynamically evaluate the overall security of the system. By comparing the comprehensive security coefficient SEC with the preset threshold, identify abnormal behavior and record logs. When the system detects an abnormal access pattern, it triggers a security alarm and takes countermeasures. Step 6: Back up key system data regularly and quickly restore data in the event of data damage or loss. Establish offline backup and cloud backup mechanisms to ensure data security.

[0014] A computer-readable storage medium is used to store computer-readable computer program instructions, wherein the computer program instructions are configured for the operation of a security protection system, providing a secure storage location to prevent backup data from being lost due to a single storage point failure.

[0015] The present invention provides a security protection method, system and storage medium for an information management system, which have the following beneficial effects: (1) When the system is running, the present invention discloses a security protection method, system and storage medium for an information management system, which relates to the field of security protection technology. During the operation of the system, multiple identity authentications are performed when a user logs in or performs sensitive operations, and the identity authentication coefficient AC is calculated. Various security parameters in the system are collected and updated in real time. A high-intensity encryption algorithm is applied to the data to be transmitted to generate an encrypted data packet. The transmission encryption coefficient EC is calculated and obtained. Based on the user role, identity and access content, corresponding access rights are set for different data, and the abnormal monitoring coefficient ADC is obtained. According to the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC, the comprehensive security coefficient SEC is calculated and obtained. The overall security of the system is dynamically evaluated. By comparing the comprehensive security coefficient SEC with a preset threshold, abnormal behavior is identified and logged. When the system detects an abnormal access mode, a security alarm is triggered and countermeasures are taken.

[0016] (2) The security protection system of this information management system realizes comprehensive protection of user identity, data transmission, access rights, abnormal behavior and data backup in the system through the coordinated work of user identity authentication module, data collection module, data encryption module, access control module, abnormal monitoring module and data backup module. Each module undertakes specific security tasks: the identity authentication module ensures the legitimacy of the user identity, the data encryption module protects the confidentiality of the transmitted data, the access control module restricts the data access rights, the abnormal monitoring module monitors abnormal behavior in real time, and the data backup module ensures the recoverability of the data. Through the close cooperation of these modules, the system can provide full-process security protection from identity authentication to data recovery, significantly reducing the risk of information leakage and data loss.

[0017] (3) Compared with traditional information management system security measures, this system has achieved significant improvements in many aspects. First, through multiple identity authentication and hierarchical permission management, the reliability of user authentication and the security of data access are improved, and unauthorized access and unauthorized data operations are reduced. Secondly, the system adopts high-intensity encryption algorithms and secure transmission protocols to effectively prevent data from being intercepted and tampered during transmission, providing higher security for user sensitive information and transaction data. At the same time, the abnormal monitoring module can timely identify and respond to potential abnormal behaviors through frequency detection, log recording and intelligent alarm response mechanism, reducing the possibility of the system being attacked maliciously. Finally, the data backup module ensures the recoverability of data after failure or attack through regular backup and storage on multiple storage media, thereby improving the disaster recovery capability of the system.

[0018] (4) Through these technical improvements, this system has achieved significant improvements in the security, stability and data recoverability of the information management system. The combination of multiple modules enables the system to have efficient and dynamic security protection capabilities, while ensuring the normal operation of the system, it can quickly identify and respond to potential threats. Compared with traditional single protection methods, this system provides more comprehensive security protection, especially suitable for retail and e-commerce fields with more sensitive data and facing complex security threats. Ultimately, the deployment of this system not only enhances the privacy protection of user data, but also improves the system's defense capabilities in the face of malicious attacks, providing a higher level of security and business continuity for the information management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A block diagram of a security protection system for an information management system according to the present invention; Figure 2 The present invention is a schematic diagram of the steps of a security protection method for an information management system. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Example 1 The present invention provides a security protection system for an information management system, see Figure 1 , including user identity authentication module, data acquisition module, data encryption module, access control module, abnormal monitoring module and data backup module; The user identity authentication module is used to perform multiple identity authentication when the user logs in or performs sensitive operations, and verifies the user's identity through passwords, biometrics and verification codes to form a verification data group, which is pre-processed and calculated to obtain: identity authentication coefficient AC; The data acquisition module is used to collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, and summarize and store the collected parameter data in the system database; The data encryption module is used to encrypt all sensitive data during data transmission. Before data transmission, a high-intensity encryption algorithm is applied to the data to be transmitted to generate an encrypted data packet. After pre-processing, the transmission encryption coefficient EC is calculated and obtained; The access control module is used to perform hierarchical authority management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, corresponding access rights are set for different data, and corresponding resource access rights are allocated to prevent users from exceeding their authority scope. The abnormal monitoring module is used to monitor user behavior and system operation, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC according to the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC, dynamically evaluate the overall security of the system, identify abnormal behavior and record logs by comparing the comprehensive security coefficient SEC with the preset threshold, and trigger a security alarm and take countermeasures when the system detects an abnormal access mode; The data backup module is used to regularly back up key system data and quickly restore data when data is damaged or lost, establish offline backup and cloud backup mechanisms, and ensure data security.

[0022] In this embodiment, multiple identity authentications are performed when a user logs in or performs sensitive operations, and the identity authentication coefficient AC is calculated. Various security parameters in the system are collected and updated in real time. A high-intensity encryption algorithm is applied to the data to be transmitted to generate an encrypted data packet. The transmission encryption coefficient EC is calculated and obtained. Based on the user role, identity and access content, hierarchical permission management is performed. According to the user type, corresponding access permissions are set for different data, and the abnormal monitoring coefficient ADC is obtained. According to the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC, the comprehensive security coefficient SEC is calculated and obtained. The overall security of the system is dynamically evaluated. By comparing the comprehensive security coefficient SEC with the preset threshold, abnormal behavior is identified and logs are recorded. When the system detects an abnormal access pattern, a security alarm is triggered and countermeasures are taken. Key system data is backed up regularly, and data can be quickly restored when data is damaged or lost. Offline backup and cloud backup mechanisms are established to ensure data security.

[0023] Example 2 This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically: the user identity authentication module includes an identity authentication unit and an identity authentication coefficient calculation unit; The identity verification unit is used to perform multiple identity verification when the user logs in or performs sensitive operations by receiving login credentials input by the user, combining password verification, one-time verification code and biometrics, and biometrics include fingerprint recognition and face recognition, so that only legitimate users can access the system; The identity authentication coefficient calculation unit is used to extract the multi-factor identity authentication success rate MFAR from the log of the identity authentication system, obtain the identity authentication strength value ATS by combining the character type and password length with the fingerprint or facial recognition matching degree, count the number of successful authentications of each user in a unit time through log records, obtain: the number of successful user identity authentications VID, form a verification data group, standardize and clean the verification data group, and obtain: the identity authentication coefficient AC after calculation; The identity verification coefficient AC is calculated by the following formula: ; In the formula, MFAR represents the multi-factor authentication success rate, ATS represents the authentication strength value, and VID represents the number of successful user authentication. They respectively represent the weight coefficients of the multi-factor authentication success rate MFAR, the authentication strength value ATS, and the number of successful user authentication times VID.

[0024] The data acquisition module includes a data collection unit and a parameter summary unit; The data collection unit is used to collect the user's operation behavior data and various security parameters in the system in real time, including key length and encryption algorithm strength; The parameter summary unit is used to integrate and classify the collected multiple types of parameter data, and store them in the system database, and continuously update the system security parameters according to the real-time operating environment.

[0025] In this embodiment, by setting the identity authentication unit and the identity authentication coefficient calculation unit in the user identity authentication module, efficient and multiple verification of user identity is achieved, and the access security of the system is enhanced. The identity authentication unit combines passwords, one-time verification codes and biometrics to ensure that only legitimate users can access the system when users log in or perform sensitive operations. The identity authentication coefficient calculation unit extracts parameters such as the multi-factor authentication success rate (MFAR), the matching degree of passwords and biometrics (ATS), and the number of successful verifications (VID) from the log to form a verification data group, and standardizes it to finally calculate the identity authentication coefficient AC. The introduction of this coefficient not only improves the accuracy and anti-attack ability of identity authentication, but also provides reliable data support for the subsequent authority allocation and abnormal monitoring of the system.

[0026] Example 3 This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically: the data encryption module includes an encryption algorithm application unit and a transmission encryption coefficient calculation unit; The encryption algorithm application unit is used to encrypt and transmit user sensitive information and transaction data using the SSL / TLS protocol and asymmetric encryption method to prevent data from being intercepted or tampered with during transmission, obtain the encryption algorithm strength AES according to the encryption algorithm, and obtain the key length Key in the system configuration or data encryption module. Len , read the currently used transmission protocol type through the network communication module or data encryption module, and obtain the transmission protocol security Prot Sec ; The transmission encryption coefficient calculation unit is used to format and package the encrypted data packet, calculate and generate the transmission encryption coefficient EC; The transmission encryption coefficient EC is calculated by the following formula: ; In the formula, AES represents the strength of the encryption algorithm, Key Len Indicates the key length, Prot Sec Indicates the security of the transmission protocol. Respectively represent the encryption algorithm strength AES and key length Key Len and Transport Protocol Security Prot Sec The weight coefficient of .

[0027] The access control module includes a role identification unit, a permission allocation unit and a permission monitoring unit; The role identification unit is used to identify the role information of the user. According to the user's login information, the system confirms the role type of the user's identity through preset role categories, including ordinary users, VIP users and administrators. By identifying the role category, the user's authority level is determined to ensure that users with different roles have different access rights; The permission allocation unit is used to allocate corresponding resource access rights to users according to their roles. Users can only access data and resources that match their role permissions, thereby preventing unauthorized data access. Ordinary users can only view and edit their personal information, VIP users can access more functions, and administrators have full control permissions; The permission monitoring unit is used to monitor the user's operating behavior in real time to ensure that the user performs operations within the scope of authority. Once it is detected that the user has unauthorized access behavior or attempts to access unauthorized resources, the permission monitoring unit immediately records the event and takes corresponding measures including warnings or blocking access.

[0028] In this embodiment, the system achieves high-strength data transmission security through the collaborative work of the encryption algorithm application unit and the transmission encryption coefficient calculation unit in the data encryption module. The encryption algorithm application unit uses the SSL / TLS protocol and asymmetric encryption method to encrypt user sensitive information and transaction data, effectively preventing data from being intercepted or tampered with during transmission. The unit obtains the encryption algorithm strength AES, key length Key according to the selected encryption algorithm, key length and transmission protocol type. Len and Transport Protocol Security Prot Sec The module is designed to improve the data's anti-interception and anti-tampering capabilities, providing a more secure transmission guarantee for the system.

[0029] Example 4 This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically: the abnormal monitoring module includes an abnormality detection unit, a log recording unit and an alarm response unit; The anomaly detection unit is used to monitor the system operation and user behavior in real time, calculate the detection frequency per unit time in real time in the anomaly monitoring module, obtain: detection frequency DET, obtain the log record integrity ratio LTR through log records, obtain the anomaly detection accuracy ADT through analysis of the detection results, identify potential abnormal situations, including frequent login failures and abnormal data access requests, use set rules or algorithms to detect abnormal patterns, obtain the anomaly monitoring coefficient ADC after calculation, and make a preliminary judgment based on the type and frequency of the anomaly, and calculate and obtain: comprehensive security factor SEC through identity authentication coefficient AC, transmission encryption coefficient EC and anomaly monitoring coefficient ADC; The abnormal monitoring coefficient ADC is calculated by the following formula: ; In the formula, DET represents the detection frequency, LTR represents the log record completeness ratio, and ADT represents the anomaly detection accuracy. They represent the weight coefficients of detection frequency DET, log record completeness ratio LTR and anomaly detection accuracy ADT respectively; The log recording unit is used to record all operation logs related to system security, including normal operations and detected abnormal behaviors, and the recorded content includes operation time, user information, access resources, operation type and abnormal mark; The alarm response unit is used to send out corresponding alarms and take corresponding measures according to the severity of the abnormality after the abnormality detection unit identifies abnormal behavior, including sending notifications or temporarily locking the account.

[0030] The comprehensive safety factor SEC is calculated by the following formula: ; In the formula, AC represents the authentication coefficient, EC represents the transmission encryption coefficient, and ADC represents the abnormal monitoring coefficient. They represent the weight coefficients of the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC respectively; By comparing the comprehensive safety factor SEC with the preset safety threshold A and the preset safety threshold B, a three-level threshold comparison evaluation strategy is obtained: When the comprehensive safety factor SEC ≥ the preset safety threshold B, the system is in a safe state and there are no potential safety hazards. Regularly check the system configuration to ensure that the settings of identity authentication, data encryption and abnormal monitoring modules meet safety standards, maintain the current operating status and monitoring frequency of safety measures, conduct safety awareness training for managers and users, improve the compliance rate of safety regulations, and prevent human operational errors. In a low-risk state, the false alarm rate and missed alarm rate of abnormal detection can be further optimized to improve the accuracy of the system's security monitoring; When the preset security threshold A≤comprehensive security factor SEC<preset security threshold B, the system is at risk. The multi-factor authentication strength of identity authentication is increased, verification codes are added or more complex biometric authentication is enabled, the authentication factor AC is increased, and the key length is increased from 128 bits to 256 bits according to system resources. A higher-strength encryption algorithm is switched to, and the frequency of data backup is increased to ensure that data can be quickly restored in the event of data loss risk, thereby ensuring data integrity and availability; When the comprehensive security factor SEC is less than the preset security threshold A, immediately enable multi-factor authentication combining passwords, biometrics and hardware security keys, limit external access traffic to the system, start 24-hour real-time monitoring and log analysis, and in high-risk situations, suspend or shut down non-critical services to reduce the attack surface and ensure the security and stability of key businesses. Immediately perform a comprehensive data backup of the system and conduct data recovery drills to ensure that the system can be quickly restored in the event of emergency data loss.

[0031] The data backup module includes a regular backup unit and a backup storage unit; The periodic backup unit is used to back up key data in the system at preset time intervals to ensure that data can be restored in the event of emergencies, including hardware failure or data corruption. When data corruption or loss is detected, the data is restored from the most recent backup to quickly restore the data to the most recent backup state, thereby shortening the system interruption time due to data loss or corruption; The backup storage unit is used to safely store the backup data on different physical or cloud storage media, including offline disks or cloud storage.

[0032] In this embodiment, through the functional integration of the abnormal monitoring module and the data backup module, the system has achieved significant improvements in security monitoring and data protection. The abnormal detection unit of the abnormal monitoring module can monitor system operations and user behaviors in real time, and calculate the abnormal monitoring coefficient ADC based on indicators such as detection frequency (DET), log record integrity (LTR) and abnormal detection accuracy (ADT), so as to effectively identify and judge potential abnormal situations, such as frequent login failures or abnormal data access requests. The log recording unit records all operation logs of the system in detail, including normal operations and abnormal behaviors, providing a strong basis for post-review and security analysis. When the alarm response unit detects an abnormality, it immediately issues an alarm and executes corresponding countermeasures (such as notifying the administrator or locking the account) according to the severity of the abnormality, which significantly improves the system's defense response speed and security.

[0033] Example 5 A security protection method for information management system, please refer to Figure 2, specifically: including the following steps: Step 1: Perform multiple authentication when the user logs in or performs sensitive operations. Verify the user's identity through password, biometrics and verification code to form a verification data group. After preprocessing, calculate the authentication coefficient AC; Step 2: Collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, summarize and store the collected parameter data in the system database; Step 3: Encrypt all sensitive data during data transmission. Before data transmission, apply a high-intensity encryption algorithm to the data to be transmitted to generate an encrypted data packet. After preprocessing, calculate and obtain the transmission encryption coefficient EC; Step 4: Perform hierarchical permission management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, set corresponding access rights for different data and allocate corresponding resource access rights to prevent users from exceeding their authority. Step 5: Monitor user behavior and system operations, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC based on the identity authentication coefficient AC, transmission encryption coefficient EC and abnormal monitoring coefficient ADC. Dynamically evaluate the overall security of the system. By comparing the comprehensive security coefficient SEC with the preset threshold, identify abnormal behavior and record logs. When the system detects an abnormal access pattern, it triggers a security alarm and takes countermeasures. Step 6: Back up key system data regularly and quickly restore data in the event of data damage or loss. Establish offline backup and cloud backup mechanisms to ensure data security.

[0034] The computer program instructions are configured to execute the operations of the security protection system for an information management system when running, provide a secure storage location, and prevent the backup data from being lost due to a single storage point failure.

[0035] In this embodiment, through the implementation of the above six steps, the security protection system significantly improves the overall security and data protection capabilities in the information management process. The multi-authentication of step one effectively verifies the user's identity through means such as passwords, biometrics and verification codes, generates the authentication coefficient AC, and ensures that only legitimate users can enter the system; step two collects and updates the user's operation data and system security parameters in real time to form a comprehensive security data pool, which provides real-time support for the protection of subsequent modules; step three encrypts sensitive data with high intensity and generates a transmission encryption coefficient EC to prevent data from being stolen or tampered with during transmission, ensuring the confidentiality and integrity of data transmission. Through the hierarchical authority management of step four, the system can assign corresponding resource access rights according to user roles and identities, effectively limit the user's authority scope, and prevent unauthorized access. In addition, step five obtains the abnormal monitoring coefficient ADC through abnormal monitoring, and comprehensively calculates the authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC to generate a comprehensive security coefficient SEC, and compares it with the preset security threshold, identifies and responds to abnormal behavior in real time, triggers alarms or takes other countermeasures, and improves the system's dynamic security assessment and protection capabilities. Finally, through the regular data backup in step 6 and the multiple backup mechanisms of offline and cloud, the system can quickly recover in the event of sudden failure or data corruption, ensuring data security and business continuity. Through the close coordination of these steps, the system achieves comprehensive protection of user identity, data transmission, access rights, abnormal behavior and data backup, making the information management system more secure, reliable and disaster-tolerant.

[0036] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A security protection system for an information management system, characterized in that: It includes user identity authentication module, data acquisition module, data encryption module, access control module, abnormal monitoring module and data backup module; The user identity authentication module is used to perform multiple identity authentication when the user logs in or performs sensitive operations, and verifies the user's identity through passwords, biometrics and verification codes to form a verification data group, which is pre-processed and calculated to obtain: identity authentication coefficient AC; The data acquisition module is used to collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, and summarize and store the collected parameter data in the system database; The data encryption module is used to encrypt all sensitive data during data transmission. Before data transmission, a high-intensity encryption algorithm is applied to the data to be transmitted to generate an encrypted data packet. After pre-processing, the transmission encryption coefficient EC is calculated and obtained; The access control module is used to perform hierarchical authority management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, corresponding access rights are set for different data, and corresponding resource access rights are allocated to prevent users from exceeding their authority scope. The abnormal monitoring module is used to monitor user behavior and system operation, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC according to the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC, dynamically evaluate the overall security of the system, identify abnormal behavior and record logs by comparing the comprehensive security coefficient SEC with the preset threshold, and trigger a security alarm and take countermeasures when the system detects an abnormal access mode; The data backup module is used to regularly back up key system data and quickly restore data when data is damaged or lost, establish offline backup and cloud backup mechanisms, and ensure data security.

2. A security protection system for an information management system according to claim 1, characterized in that: The user identity authentication module includes an identity authentication unit and an identity authentication coefficient calculation unit; The identity verification unit is used to perform multiple identity verification when the user logs in or performs sensitive operations by receiving login credentials input by the user, combining password verification, one-time verification code and biometrics, and biometrics include fingerprint recognition and face recognition, so that only legitimate users can access the system; The identity authentication coefficient calculation unit is used to extract the multi-factor identity authentication success rate MFAR from the log of the identity authentication system, obtain the identity authentication strength value ATS by combining the character type and password length with the fingerprint or facial recognition matching degree, count the number of successful authentications of each user in a unit time through log records, obtain: the number of successful user identity authentications VID, form a verification data group, standardize and clean the verification data group, and obtain: the identity authentication coefficient AC after calculation; The identity verification coefficient AC is calculated by the following formula: ； In the formula, MFAR represents the multi-factor authentication success rate, ATS represents the authentication strength value, and VID represents the number of successful user authentication. They respectively represent the weight coefficients of the multi-factor authentication success rate MFAR, the authentication strength value ATS, and the number of successful user authentication times VID.

3. A security protection system for an information management system according to claim 1, characterized in that: The data acquisition module includes a data collection unit and a parameter summary unit; The data collection unit is used to collect the user's operation behavior data and various security parameters in the system in real time, including key length and encryption algorithm strength; The parameter summary unit is used to integrate and classify the collected multiple types of parameter data, and store them in the system database, and continuously update the system security parameters according to the real-time operating environment.

4. A security protection system for an information management system according to claim 1, characterized in that: The data encryption module includes an encryption algorithm application unit and a transmission encryption coefficient calculation unit; The encryption algorithm application unit is used to encrypt and transmit user sensitive information and transaction data using the SSL / TLS protocol and asymmetric encryption method to prevent data from being intercepted or tampered with during transmission, obtain the encryption algorithm strength AES according to the encryption algorithm, and obtain the key length Key in the system configuration or data encryption module. Len , read the currently used transmission protocol type through the network communication module or data encryption module, and obtain the transmission protocol security Prot Sec ; The transmission encryption coefficient calculation unit is used to format and package the encrypted data packet, calculate and generate the transmission encryption coefficient EC; The transmission encryption coefficient EC is calculated by the following formula: ； In the formula, AES represents the strength of the encryption algorithm, Key Len Indicates the key length, Prot Sec Indicates the security of the transmission protocol. Respectively represent the encryption algorithm strength AES and key length Key Len and Transport Protocol Security Prot Sec The weight coefficient of .

5. A security protection system for an information management system according to claim 1, characterized in that: The access control module includes a role identification unit, a permission allocation unit and a permission monitoring unit; The role identification unit is used to identify the role information of the user. According to the user's login information, the system confirms the role type of the user's identity through preset role categories, including ordinary users, VIP users and administrators. By identifying the role category, the user's authority level is determined to ensure that users with different roles have different access rights; The permission allocation unit is used to allocate corresponding resource access rights to users according to their roles. Users can only access data and resources that match their role permissions, thereby preventing unauthorized data access. Ordinary users can only view and edit their personal information, VIP users can access more functions, and administrators have full control permissions; The permission monitoring unit is used to monitor the user's operating behavior in real time to ensure that the user performs operations within the scope of authority. Once it is detected that the user has unauthorized access behavior or attempts to access unauthorized resources, the permission monitoring unit immediately records the event and takes corresponding measures including warnings or blocking access.

6. A security protection system for an information management system according to claim 1, characterized in that: The abnormality monitoring module includes an abnormality detection unit, a log recording unit and an alarm response unit; The anomaly detection unit is used to monitor the system operation and user behavior in real time, calculate the detection frequency per unit time in real time in the anomaly monitoring module, obtain: detection frequency DET, obtain the log record integrity ratio LTR through log records, obtain the anomaly detection accuracy ADT through analysis of the detection results, identify potential abnormal situations, including frequent login failures and abnormal data access requests, use set rules or algorithms to detect abnormal patterns, obtain the anomaly monitoring coefficient ADC after calculation, and make a preliminary judgment based on the type and frequency of the anomaly, and calculate and obtain: comprehensive security factor SEC through identity authentication coefficient AC, transmission encryption coefficient EC and anomaly monitoring coefficient ADC; The abnormal monitoring coefficient ADC is calculated by the following formula: ； In the formula, DET represents the detection frequency, LTR represents the log record completeness ratio, and ADT represents the anomaly detection accuracy. They represent the weight coefficients of detection frequency DET, log record completeness ratio LTR and anomaly detection accuracy ADT respectively; The log recording unit is used to record all operation logs related to system security, including normal operations and detected abnormal behaviors, and the recorded content includes operation time, user information, access resources, operation type and abnormal mark; The alarm response unit is used to send out corresponding alarms and take corresponding measures according to the severity of the abnormality after the abnormality detection unit identifies abnormal behavior, including sending notifications or temporarily locking the account.

7. A security protection system for an information management system according to claim 6, characterized in that: The comprehensive safety factor SEC is calculated by the following formula: ； In the formula, AC represents the authentication coefficient, EC represents the transmission encryption coefficient, and ADC represents the abnormal monitoring coefficient. They represent the weight coefficients of the identity authentication coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC respectively; By comparing the comprehensive safety factor SEC with the preset safety threshold A and the preset safety threshold B, a three-level threshold comparison evaluation strategy is obtained: When the comprehensive safety factor SEC ≥ the preset safety threshold B, the system is in a safe state and there are no safety hazards. Regularly check the system configuration to ensure that the settings of identity authentication, data encryption and abnormal monitoring modules meet safety standards and maintain the current operating status and monitoring frequency of safety measures; When the preset security threshold A≤comprehensive security factor SEC<preset security threshold B, the system is at risk. The multi-factor authentication strength of identity authentication should be increased, verification codes should be added or more complex biometric authentication should be enabled, the authentication factor AC should be increased, and the key length should be increased or a higher strength encryption algorithm should be switched according to the system resources. When the comprehensive security factor SEC is less than the preset security threshold A, multi-factor authentication combining passwords, biometrics and hardware security keys is immediately enabled, external access traffic to the system is restricted, and 24-hour real-time monitoring and log analysis are started.

8. A security protection system for an information management system according to claim 1, characterized in that: The data backup module includes a regular backup unit and a backup storage unit; The periodic backup unit is used to back up key data in the system at preset time intervals to ensure that data can be restored in the event of emergencies, including hardware failure or data corruption. When data corruption or loss is detected, the data is restored from the most recent backup to quickly restore the data to the most recent backup state, thereby shortening the system interruption time due to data loss or corruption; The backup storage unit is used to safely store the backup data on different physical or cloud storage media, including offline disks or cloud storage.

9. A security protection method for an information management system, applied to a security protection system for an information management system as claimed in any one of claims 1 to 8, characterized in that: The following steps are involved: Step 1: Perform multiple authentication when the user logs in or performs sensitive operations. Verify the user's identity through password, biometrics and verification code to form a verification data group. After preprocessing, calculate the authentication coefficient AC; Step 2: Collect and update various security parameters in the system in real time, collect various operation data generated by users during access to the system, summarize and store the collected parameter data in the system database; Step 3: Encrypt all sensitive data during data transmission. Before data transmission, apply a high-intensity encryption algorithm to the data to be transmitted to generate an encrypted data packet. After preprocessing, calculate and obtain the transmission encryption coefficient EC; Step 4: Perform hierarchical permission management based on user roles, identities and access content. According to user types, including ordinary users, VIP users and administrators, set corresponding access rights for different data and allocate corresponding resource access rights to prevent users from exceeding their authority. Step 5: Monitor user behavior and system operations, obtain the abnormal monitoring coefficient ADC, and calculate the comprehensive security coefficient SEC based on the identity authentication coefficient AC, transmission encryption coefficient EC and abnormal monitoring coefficient ADC. Dynamically evaluate the overall security of the system. By comparing the comprehensive security coefficient SEC with the preset threshold, identify abnormal behavior and record logs. When the system detects an abnormal access pattern, it triggers a security alarm and takes countermeasures. Step 6: Back up key system data regularly and quickly restore data in the event of data damage or loss. Establish offline backup and cloud backup mechanisms to ensure data security.

10. A computer-readable storage medium for storing computer program instructions readable by a computer, characterized in that: The computer program instructions are configured to execute, when running, the operations of a security protection system for an information management system as described in any one of claims 1 to 8, to provide a secure storage location to prevent backup data from being lost due to failure of a single storage point.

Images