Data asset security assessment method and assessment system

Abstract

The invention relates to the field of data processing, and discloses a data asset security assessment method and system, and the method comprises the steps that a security assessment module receives a data asset access request, extracts access features according to the access request, obtains an access request authorization state based on the access features, and carries out the security assessment if the access request authorization state is the authorization state; the user permission is determined according to user identity information in the access features, if the user is a known user, the security evaluation module obtains known user access behavior data and verifies the known user access behavior data and a corresponding user behavior mode stored in the cloud data server, and if the verification succeeds, the user permission is determined to be the known user. If yes, the security evaluation module judges data asset access security; and completing data asset security assessment. According to the invention, comprehensive and accurate security assessment of the data asset access request can be realized.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a data asset security assessment method and assessment system. Background Art

[0002] With the rapid development of information technology, data has become an indispensable asset for enterprises, organizations and even individuals. The value of data lies in its ability to provide information, guide decision-making, optimize processes, etc., but at the same time, the security of data is becoming increasingly prominent. Frequent security incidents such as data leakage, illegal access, tampering or destruction have brought huge economic losses and legal risks to the owners of data assets. Therefore, how to effectively evaluate and manage the security of data assets has become an urgent problem to be solved.

[0003] Traditional data security protection methods, such as firewalls, intrusion detection systems (IDS), and antivirus software, can resist external threats to a certain extent, but they are powerless in the face of malicious behavior or misoperation by internal personnel, as well as increasingly complex network attack methods. In addition, traditional methods often focus on post-event defense and remediation, and lack active assessment and early warning mechanisms for data asset security.

[0004] Although there are some data security assessment methods in the prior art, most of them have the following problems: First, the assessment dimension is single, and only single factors such as user identity or access instructions are considered, ignoring the complexity and diversity of access behavior; second, the assessment process lacks intelligence and cannot automatically adjust the assessment strategy according to the user's historical access behavior, resulting in limited accuracy and efficiency of the assessment results; third, there is a lack of effective integration with cloud data servers, and it is impossible to fully utilize cloud resources to enhance the real-time and accuracy of the assessment. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a data asset security assessment method, comprising the following steps: Step 1: The security assessment module receives a data asset access request, extracts access features based on the access request, and based on the access features, obtains the authorization status of the access request. If it is an authorized status, it proceeds to step 2; if it is an unauthorized status, it ignores the received data asset access request. Step 2: Determine the user's authority based on the user identity information in the access feature. If the user is a known user, proceed to step 3; otherwise, if the user is an unknown user, proceed to step 4. Step 3: The security assessment module obtains the known user access behavior data and verifies the known user access behavior data with the corresponding user behavior pattern stored in the cloud data server. If the verification is successful, the security assessment module determines the data asset access security and proceeds to step 6. If the verification fails, it is a data asset access risk and the security assessment module triggers a security alarm. Step 4: The security assessment module obtains the unknown user access behavior data, and obtains the primary access feature based on the obtained unknown user access behavior data, obtains the data asset security access policy matching the primary access feature in the cloud data server, generates the security policy corresponding to the primary access feature, and sends it to the security assessment module to enter step 5; Step 5: The security assessment module performs a consistency check on the user access behavior data according to the security policy corresponding to the primary access feature sent by the cloud data server. If they are consistent, the data asset access is judged to be safe until the data asset access is completed and the process proceeds to step 6. Otherwise, it is a data asset access risk and the security assessment module triggers a security alarm. Step six: Complete the data asset security assessment.

[0006] Furthermore, the security assessment module receives a data asset access request, extracts access features according to the access request, and based on the access features, the security assessment module obtains the access request authorization status, including: The access characteristics include access user identity information and authorization access instructions, wherein the access user identity information includes user account and identity verification information; the authorization access instructions include authorization verification information and authorization access instructions; The authorized access instructions include data query instructions, data download instructions, data modification instructions and data upload instructions; The security assessment module verifies the authorization verification information. If the authorized user identity information in the authorization verification information is consistent with the access user identity information, a response is made; otherwise, no response is made.

[0007] Furthermore, determining the user rights according to the user identity information in the access characteristics includes: If the user account is a user who is registered and authenticated in the cloud data server for the first time, it is an unknown user; otherwise, it is a known user.

[0008] Furthermore, the security assessment module obtains user access behavior data and verifies the user access behavior data with corresponding known user behavior patterns stored in the cloud data server, including: The cloud data server generates the behavior pattern of the corresponding user based on the historical access behavior data of known users, compares the access behavior data of known users with the behavior pattern of the corresponding users, and obtains the degree of deviation of the known user's access behavior. If the degree of deviation of the known user's access behavior is greater than the warning deviation threshold, a data asset access risk warning is issued; the access feature items included in the behavior pattern are: access time, accessed data asset type, and access instructions.

[0009] Furthermore, the degree of deviation of the user access behavior is: If the access feature items obtained based on the known user access behavior data are consistent with the access feature items in the corresponding user's behavior pattern, the known user's access behavior has not deviated; otherwise, the user's access behavior has deviated. The degree of deviation of the known user's access behavior is obtained based on the sum of the warning deviation values ​​corresponding to each inconsistent access feature item.

[0010] Furthermore, the security assessment module obtains unknown user access behavior data, obtains primary access features based on the obtained unknown user access behavior data, and obtains a data asset security access strategy matching the primary access features on the cloud data server, including: The primary access feature mentioned is: obtaining the type of data assets accessed in the access behavior data, the type of data assets accessed and the authorization access instructions constitute the primary access feature; according to the primary access feature, matching the data asset security access policy corresponding to the type of data assets accessed in the cloud data server.

[0011] Furthermore, the security assessment module performs a consistency check with the unknown user access behavior data based on the security policy corresponding to the primary access feature sent by the cloud data server, including: Obtain the accessible instructions for data assets in the security policy corresponding to the primary access feature. If the access instructions in the unknown user access behavior data are consistent with the accessible instructions for data assets in the security policy, the consistency check passes; otherwise, the consistency check fails.

[0012] A data asset security assessment system, applying the data asset security assessment method, comprises: a cloud data server, a security assessment module, a data acquisition module, a communication module, a data processing module and a user terminal device; The security assessment module, data acquisition module and communication module are respectively connected to the data processing module; the cloud data server and user terminal device are respectively connected to the communication module for communication.

[0013] Beneficial effects: Improved accuracy and efficiency of security assessment: By comprehensively considering multiple factors such as the source of access requests, the identity and permissions of users, the characteristics of access behavior, and the sensitivity of data assets themselves, the present invention can achieve a comprehensive and accurate security assessment of data asset access requests. At the same time, with the powerful computing power and storage capacity of cloud data servers, the present invention can complete the assessment process in real time and quickly, improving the efficiency of the assessment.

[0014] Enhanced intelligent level of security assessment: The present invention can automatically generate the behavior pattern of the corresponding user based on the user's historical access behavior, and intelligently evaluate the current access behavior based on these behavior patterns. This intelligent evaluation method can automatically adjust the evaluation strategy to adapt to the behavior habits and security requirements of different users, thereby improving the accuracy and flexibility of the evaluation.

[0015] Effectively prevent internal threats and external attacks: The present invention can not only effectively intercept illegal external access, but also monitor and warn malicious behavior or misoperation of internal personnel in real time. By triggering security alarms, the present invention can timely discover and deal with potential security risks, effectively ensuring the security of data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a data asset security assessment method based on deep learning; Figure 2 This is a schematic diagram of the principle of a data asset security assessment system based on deep learning; Figure 3 The schematic diagram of the safety assessment module. DETAILED DESCRIPTION

[0017] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings, but the protection scope of the present invention is not limited to the following.

[0018] The features and performance of the present invention are further described in detail below in conjunction with the embodiments.

[0019] like Figure 1 As shown, a data asset security assessment method includes the following steps: Step 1: The security assessment module receives a data asset access request, extracts access features based on the access request, and based on the access features, obtains the authorization status of the access request. If it is an authorized status, it proceeds to step 2; if it is an unauthorized status, it ignores the received data asset access request. Step 2: Determine the user's authority based on the user identity information in the access feature. If the user is a known user, proceed to step 3; otherwise, if the user is an unknown user, proceed to step 4. Step 3: The security assessment module obtains the known user access behavior data and verifies the known user access behavior data with the corresponding user behavior pattern stored in the cloud data server. If the verification is successful, the security assessment module determines the data asset access security and proceeds to step 6. If the verification fails, it is a data asset access risk and the security assessment module triggers a security alarm. Step 4: The security assessment module obtains the unknown user access behavior data, and obtains the primary access feature based on the obtained unknown user access behavior data, obtains the data asset security access policy matching the primary access feature in the cloud data server, generates the security policy corresponding to the primary access feature, and sends it to the security assessment module to enter step 5; Step 5: The security assessment module performs a consistency check on the user access behavior data according to the security policy corresponding to the primary access feature sent by the cloud data server. If they are consistent, the data asset access is judged to be safe until the data asset access is completed and the process proceeds to step 6. Otherwise, it is a data asset access risk and the security assessment module triggers a security alarm. Step six: Complete the data asset security assessment.

[0020] The security assessment module receives a data asset access request, extracts access features according to the access request, and based on the access features, obtains the authorization status of the access request, including: The access characteristics include access user identity information and authorization access instructions, wherein the access user identity information includes user account and identity verification information; the authorization access instructions include authorization verification information and authorization access instructions; The authorized access instructions include data query instructions, data download instructions, data modification instructions and data upload instructions; The security assessment module verifies the authorization verification information. If the authorized user identity information in the authorization verification information is consistent with the access user identity information, a response is made; otherwise, no response is made.

[0021] Determining the user rights according to the user identity information in the access characteristics includes: If the user account is a user who is registered and authenticated in the cloud data server for the first time, it is an unknown user; otherwise, it is a known user.

[0022] The security assessment module obtains user access behavior data and verifies the user access behavior data with corresponding known user behavior patterns stored in the cloud data server, including: The cloud data server generates the behavior pattern of the corresponding user based on the historical access behavior data of known users, compares the access behavior data of known users with the behavior pattern of the corresponding users, and obtains the degree of deviation of the known user's access behavior. If the degree of deviation of the known user's access behavior is greater than the warning deviation threshold, a data asset access risk warning is issued; the access feature items included in the behavior pattern are: access time, accessed data asset type, and access instructions.

[0023] The degree of deviation of the user access behavior is: If the access feature items obtained based on the known user access behavior data are consistent with the access feature items in the corresponding user's behavior pattern, the known user's access behavior has not deviated; otherwise, the user's access behavior has deviated. The degree of deviation of the known user's access behavior is obtained based on the sum of the warning deviation values ​​corresponding to each inconsistent access feature item.

[0024] The security assessment module obtains unknown user access behavior data, obtains primary access features based on the obtained unknown user access behavior data, and obtains a data asset security access strategy matching the primary access features on the cloud data server, including: The primary access feature mentioned is: obtaining the type of data assets accessed in the access behavior data, the type of data assets accessed and the authorization access instructions constitute the primary access feature; according to the primary access feature, matching the data asset security access policy corresponding to the type of data assets accessed in the cloud data server.

[0025] The security assessment module performs a consistency check with the unknown user access behavior data based on the security policy corresponding to the primary access feature sent by the cloud data server, including: Obtain the accessible instructions for data assets in the security policy corresponding to the primary access feature. If the access instructions in the unknown user access behavior data are consistent with the accessible instructions for data assets in the security policy, the consistency check passes; otherwise, the consistency check fails.

[0026] like Figure 2 As shown, a data asset security assessment system, applying the data asset security assessment method, includes: a cloud data server, a security assessment module, a data acquisition module, a communication module, a data processing module and a user terminal device; The security assessment module, data acquisition module and communication module are respectively connected to the data processing module; the cloud data server and user terminal device are respectively connected to the communication module for communication.

[0027] like Figure 3The security assessment module shown includes a security verification module and an access feature extraction module; the security verification module and the access feature extraction module are respectively connected to the data processing module.

[0028] Specifically, the present invention provides a data asset security assessment method, which includes the following steps: Step 1: After the security assessment module receives a data asset access request, it first extracts access features based on the access request. These access features include, but are not limited to, access user identity information and authorized access instructions. Among them, access user identity information includes user account, identity verification information, etc., which are used to confirm the identity of the visitor; authorized access instructions include authorization verification information and specific access instructions, such as data query instructions, data download instructions, data modification instructions, and data upload instructions, etc., which are used to clarify the visitor's operation intentions. Based on these access features, the security assessment module will further obtain the authorization status of the access request. If it is an authorized state, that is, the visitor's identity and operation are authorized, then proceed to step 2; if it is an unauthorized state, the received data asset access request is directly ignored to ensure that illegal access is effectively intercepted.

[0029] Step 2: After confirming that the access request is in the authorized state, the security assessment module will determine the user's permissions based on the user identity information in the access characteristics. This step is mainly to determine whether the visitor is a known user or an unknown user. If the user account is a user who has registered and authenticated in the cloud data server for the first time, it is considered an unknown user and proceeds to step 4 for further security assessment; otherwise, it is considered a known user and proceeds to step 3.

[0030] Step 3: For known users, the security assessment module will obtain their access behavior data and verify this data with the corresponding user behavior patterns stored in the cloud data server. The cloud data server will generate the corresponding user's behavior pattern based on the historical access behavior data of known users. These behavior patterns include access time, accessed data asset type, and access instructions and other access feature items. By comparing the current access behavior data with the behavior pattern, the degree of deviation of the known user's access behavior can be calculated. If the degree of deviation is greater than the warning deviation degree threshold, it indicates that the user behavior is abnormal and there may be a risk of data asset access. At this time, the security assessment module will trigger a security alarm; if the verification is successful, that is, the user behavior is consistent with its behavior pattern, then the data asset access security is judged and the process proceeds to step six.

[0031] Step 4: For unknown users, the security assessment module obtains their access behavior data and obtains the primary access features based on this data. The primary access features mainly include the type of data assets accessed and the authorized access instructions. Subsequently, the security assessment module matches the data asset security access policies corresponding to the type of data assets accessed in the cloud data server. These policies are formulated based on the sensitivity and security requirements of different types of data assets and are used to guide how to conduct security assessments on access requests.

[0032] Step 5: The security assessment module performs a consistency check on the unknown user's access behavior data based on the security policy corresponding to the primary access feature sent by the cloud data server. Specifically, it obtains the accessible instructions of the data assets in the security policy and compares them with the access instructions in the unknown user's access behavior data. If the two are consistent, the consistency check passes and the data asset access is judged to be safe; otherwise, the consistency check fails and is considered a data asset access risk, and the security assessment module triggers a security alarm.

[0033] Step 6: Regardless of whether it is a known user or an unknown user, as long as their access behavior is judged to be safe, the data asset security assessment can be completed and they can be allowed to access data assets.

[0034] Furthermore, the present invention also provides specific implementation details of the method: In step one, when the security assessment module verifies the authorization verification information, it will strictly compare the consistency of the authorized user identity information and the access user identity information to ensure that only authorized users can access data assets.

[0035] In step three, when calculating the deviation degree of known user access behavior, the warning deviation values ​​corresponding to each inconsistent access feature item will be comprehensively considered to obtain a more comprehensive and accurate deviation degree assessment result.

[0036] In step four, when matching data asset security access policies, the sensitivity and security requirements of data assets will be fully considered to ensure that the formulated policies can effectively prevent security risks while not excessively restricting users' normal access needs.

[0037] In addition, the present invention also provides a data asset security assessment system, which applies the above-mentioned data asset security assessment method, including a cloud data server, a security assessment module, a data acquisition module, a data processing module and a communication module. Among them, the security assessment module, the data acquisition module and the communication module are respectively connected to the data processing module to realize data collection, processing and transmission; the cloud data server is connected to the communication module for communication, and is used to store key information such as user behavior patterns and data asset security access policies, and provide necessary support for security assessment. The security assessment module also includes a security verification module and an access feature extraction module, which are respectively used to realize security verification of access requests and extraction of access features.

[0038] Embodiment 1 A financial company uses the data asset security assessment method provided by the present invention to protect its data assets stored in the cloud, including sensitive data such as customer transaction records and personal identity information. The company hopes to ensure that only authorized employees can access this data and that the access behavior is consistent with normal business operation patterns.

[0039] Specific implementation steps: Step 1: An employee submits a data query request through the company's internal system, intending to query the transaction records of a specific customer. After receiving the request, the security assessment module first extracts the access features, including the employee's account number (such as work number), identity verification information (such as password or biometric information), and specific query instructions. By verifying this information, it is confirmed that the employee is an authorized user and proceeds to step 2.

[0040] Step 2: The security assessment module determines that the employee's account is a known user because the account has been registered and authenticated in the cloud data server. Then proceed to step 3.

[0041] Step 3: The security assessment module obtains the employee's historical access behavior data from the cloud data server and generates its behavior pattern, including the usual access time, the type of data accessed (such as transaction records, customer information), and commonly used query commands, etc. By comparing the current access behavior with the behavior pattern, it is found that the access time, data type, and command are consistent with the historical pattern, and the deviation degree is lower than the warning deviation degree threshold. The verification is successful and enters step 6.

[0042] Step 6: Because the employee's access behavior is judged to be safe, the security assessment module allows the access request and the employee successfully queries the transaction records of the required customers.

[0043] Implementation details: In step 1, the security assessment module uses multi-factor authentication technology to strictly verify the identity information of employees, including passwords and biometric information, to ensure the authenticity of the identity. In step 3, the calculation of the degree of deviation takes into account the access time (whether it is during working hours), the type of data accessed (whether it is related to the employee's duties) and the complexity of the query instructions to ensure the comprehensiveness and accuracy of the assessment.

[0044] Embodiment 2 A medical institution uses the present invention to manage its medical database, which includes highly sensitive data such as patients' medical records, diagnosis reports, etc. The institution hopes to ensure that external collaborators can securely access specific data sets while preventing unauthorized access and internal data leakage.

[0045] Specific implementation steps: Step 1: An external collaborating researcher submits a data download request through a dedicated interface provided by a medical institution, requesting to download a research dataset for a specific disease. After receiving the request, the security assessment module extracts access features, including the researcher's account (issued in advance by the institution), identity verification information (such as a one-time verification code), and data download instructions. After verification, proceed to step 2.

[0046] Step 2: Since the researcher’s account is registered in the cloud data server for the first time, the security assessment module regards it as an unknown user and proceeds to step 4.

[0047] Step 4: The security assessment module obtains the researcher's access behavior data, focusing on the type of data assets requested (i.e., disease-specific research datasets) and data download instructions. Subsequently, the cloud data server matches the security access policy for the corresponding data type, which specifies which datasets can be accessed by external researchers and the types of access instructions allowed.

[0048] Step 5: The security assessment module performs a consistency check on the researcher's access behavior data based on the matched security policy. Confirm that the data set and download instructions requested by the researcher meet the policy requirements, the consistency check passes, and proceed to step 6.

[0049] Step 6: The researcher’s access behavior is judged to be safe, and the security assessment module allows the download request. The researcher successfully obtains the required research data set.

[0050] Implementation details: In step 1, to ensure the authenticity of the identity of external researchers, the security assessment module uses two-factor authentication, including account and password and a one-time verification code sent via email or SMS. In step 4, when formulating data asset security access strategies, medical institutions fully consider the sensitivity and research needs of different types of data sets to ensure that the strategies are both strict and reasonable, protecting patient privacy and supporting scientific research.

Claims

1. A data asset security assessment method, characterized in that: The steps include: Step 1: The security assessment module receives a data asset access request, extracts access features based on the access request, and based on the access features, obtains the authorization status of the access request. If it is an authorized status, it proceeds to step 2; if it is an unauthorized status, it ignores the received data asset access request. Step 2: Determine the user's authority based on the user identity information in the access feature. If the user is a known user, proceed to step 3; otherwise, if the user is an unknown user, proceed to step 4. Step 3: The security assessment module obtains the known user access behavior data and verifies the known user access behavior data with the corresponding known user behavior pattern stored in the cloud data server. If the verification is successful, the security assessment module determines the data asset access security and proceeds to step 6. If the verification fails, it is a data asset access risk and the security assessment module triggers a security alarm. Step 4: The security assessment module obtains the unknown user access behavior data, and obtains the primary access feature based on the obtained unknown user access behavior data, obtains the data asset security access policy matching the primary access feature in the cloud data server, generates the security policy corresponding to the primary access feature, and sends it to the security assessment module to enter step 5; Step 5: The security assessment module performs a consistency check on the user access behavior data according to the security policy corresponding to the primary access feature sent by the cloud data server. If they are consistent, the data asset access is judged to be safe until the data asset access is completed and the process proceeds to step 6. Otherwise, it is a data asset access risk and the security assessment module triggers a security alarm. Step six: Complete the data asset security assessment.

2. A data asset security assessment method according to claim 1, characterized in that: The security assessment module receives a data asset access request, extracts access features according to the access request, and based on the access features, obtains the authorization status of the access request, including: The access characteristics include access user identity information and authorization access instructions, wherein the access user identity information includes user account and identity verification information; the authorization access instructions include authorization verification information and authorization access instructions; The authorized access instructions include data query instructions, data download instructions, data modification instructions and data upload instructions; The security assessment module verifies the authorization verification information. If the authorized user identity information in the authorization verification information is consistent with the access user identity information, a response is made; otherwise, no response is made.

3. A data asset security assessment method according to claim 2, characterized in that: The determining of user rights according to user identity information in the access characteristics includes: If the user account is a user who is registered and authenticated in the cloud data server for the first time, it is an unknown user; otherwise, it is a known user.

4. A data asset security assessment method according to claim 3, characterized in that: The security assessment module obtains user access behavior data and verifies the user access behavior data with corresponding known user behavior patterns stored in the cloud data server, including: The cloud data server generates the behavior pattern of the corresponding user based on the historical access behavior data of known users, compares the access behavior data of known users with the behavior pattern of the corresponding users, and obtains the degree of deviation of the known user's access behavior. If the degree of deviation of the known user's access behavior is greater than the warning deviation threshold, a data asset access risk warning is issued; the access feature items included in the behavior pattern are: access time, accessed data asset type, and access instructions.

5. A data asset security assessment method according to claim 4, characterized in that: The degree of deviation of the user access behavior is: If the access feature items obtained based on the known user access behavior data are consistent with the access feature items in the corresponding user's behavior pattern, the known user's access behavior has not deviated; otherwise, the user's access behavior has deviated. The degree of deviation of the known user's access behavior is obtained based on the sum of the warning deviation values ​​corresponding to each inconsistent access feature item.

6. A data asset security assessment method according to claim 3, characterized in that: The security assessment module obtains unknown user access behavior data, obtains primary access features based on the obtained unknown user access behavior data, and obtains a data asset security access strategy matching the primary access features on the cloud data server, including: The primary access feature mentioned is: obtaining the type of data assets accessed in the access behavior data, the type of data assets accessed and the authorization access instructions constitute the primary access feature; according to the primary access feature, matching the data asset security access policy corresponding to the type of data assets accessed in the cloud data server.

7. A data asset security assessment method according to claim 6, characterized in that: The security assessment module performs a consistency check with the unknown user access behavior data based on the security policy corresponding to the primary access feature sent by the cloud data server, including: Obtain the accessible instructions for data assets in the security policy corresponding to the primary access feature. If the access instructions in the unknown user access behavior data are consistent with the accessible instructions for data assets in the security policy, the consistency check passes; otherwise, the consistency check fails.

8. A data asset security assessment system, characterized in that: A data asset security assessment method according to any one of claims 1 to 7 is applied, comprising: a cloud data server, a security assessment module, a data acquisition module, a communication module, a data processing module and a user terminal device; The security assessment module, data acquisition module and communication module are respectively connected to the data processing module; the cloud data server and user terminal device are respectively connected to the communication module for communication.

Images