Dynamic access control policy system based on behavior

Abstract

The invention discloses a dynamic access control strategy system based on behaviors, comprising: A, a behavior acquisition module for acquiring user behavior data in real time, the behavior data comprising login information, operation records, access resources, access time, access frequency and equipment information; b, the behavior analysis module is used for carrying out preprocessing, behavior pattern recognition and anomaly detection on the collected behavior data to generate a behavior analysis result; c, an access decision module which dynamically generates an access control decision in combination with user identity information, a behavior analysis result and a resource authority requirement; and D, a strategy updating module which updates the access control strategy in real time according to the security audit result, the user feedback and the new threat information. Compared with the prior art, the method has the advantages that a dynamic access control strategy based on behaviors is provided, the access authority of the user is dynamically adjusted by collecting and analyzing the user behavior data in real time, and finer, more flexible and safer access control is achieved.

Description

Technical Field

[0001] The present invention relates to the field of dynamic access technology, and in particular to a behavior-based dynamic access control policy system. Background Art

[0002] In today's information age, enterprises and organizations store vast amounts of important data and resources in their information systems, and their security is crucial. Access control, a core technology in information security, aims to ensure that only authorized users can access resources and prevent unauthorized access and manipulation. Traditional access control strategies primarily include discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC). However, these traditional strategies have limitations, such as a lack of dynamic analysis of user behavior, an inability to adjust access rights based on real-time user behavior, and difficulty adapting to complex and changing network environments and evolving user behavior patterns.

[0003] As network attack methods become increasingly diverse and intelligent, attackers may exploit the identities of legitimate users to gain unauthorized access or perform malicious operations. Traditional identity- and role-based access control strategies are unable to effectively address such threats. Therefore, a more flexible and dynamic access control strategy is needed that can evaluate user access rights in real time based on user behavior, thereby improving system security and reliability.

[0004] The shortcomings of traditional access control strategies

[0005] (1) Discretionary Access Control (DAC):

[0006] Discretionary access control (DAC) is a more relaxed access control strategy that allows users to determine their own access rights to resources. In DAC, resource owners can directly set other users' access rights to that resource, such as read, write, and execute permissions. The advantage of this strategy is its flexibility, allowing users to customize permissions based on their needs. However, its disadvantages are also significant: it is less secure and susceptible to insider attacks and misuse. For example, a user might mistakenly grant access to important resources to an unrelated user, or an attacker might exploit the identity of a legitimate user to gain access to resources.

[0007] (2) Mandatory Access Control (MAC):

[0008] Mandatory access control (MAC) is a stricter access control strategy that implements access control based on the security levels of subjects and objects. In MAC, each subject and object is assigned a security level, such as Top Secret, Confidential, Secret, or Public. Subjects can only access objects with a security level no higher than their own. The advantage of this strategy is its high security, effectively preventing unauthorized information leaks. However, its disadvantage is its limited flexibility, making it difficult to adapt to complex business needs. For example, within an enterprise, different departments may need to share some resources, but the strict security level restrictions of MAC may make resource sharing difficult.

[0009] (3) Role-based access control (RBAC):

[0010] Role-based access control (RBAC) is a role-based access control strategy that assigns users to different roles, each with corresponding access permissions. Users indirectly gain access to resources through their roles. This strategy simplifies and improves permission management efficiency. However, it lacks dynamic analysis of user behavior and cannot adjust access permissions based on real-time user behavior. For example, a user may belong to a role and have all the access permissions of that role. However, if the user exhibits abnormal behavior in actual operations, RBAC cannot promptly revoke their access permissions.

[0011] In summary, traditional access control strategies primarily rely on user identity and role, lacking dynamic analysis and real-time response to user behavior, making them incapable of addressing complex and ever-changing security threats. Therefore, a new access control strategy is needed that can dynamically adjust access permissions based on user behavior, achieving more refined, flexible, and secure access control. Summary of the Invention

[0012] The technical problem to be solved by the present invention is to provide a behavior-based dynamic access control policy system in view of the deficiencies raised in the above background technology.

[0013] To solve the above technical problems, the present invention provides a technical solution: a behavior-based dynamic access control policy system, which includes

[0014] A. Behavior collection module, used to collect user behavior data in real time, including login information, operation records, access resources, access time, access frequency and device information;

[0015] B. Behavior analysis module, used to pre-process the collected behavior data, identify behavior patterns and detect anomalies, and generate behavior analysis results;

[0016] C. Access decision module, which dynamically generates access control decisions based on user identity information, behavior analysis results, and resource permission requirements;

[0017] D. Policy update module, updates access control policies in real time based on security audit results, user feedback and new threat information.

[0018] Furthermore, the behavior collection module collects data in the following ways:

[0019] A. Logging: Deploy logging functions in the operating system, applications, and databases to record user logins, operations, and access logs;

[0020] B. Sensors: Monitor network traffic, system processes, and application operations in real time through network sensors, host sensors, or application sensors;

[0021] C. API interface: Connect with the identity authentication system and log management system through API to obtain user behavior data.

[0022] Furthermore, the behavior collection module ensures data integrity and security through data verification, encrypted transmission (such as HTTPS / SSL) and regular backup.

[0023] Furthermore, the behavior analysis module includes:

[0024] A. Data preprocessing unit, used to remove noise, fill missing values, and unify data formats;

[0025] B. Behavior modeling unit, which uses cluster analysis and anomaly detection algorithms (such as statistical methods, SVM, neural networks) to establish a baseline of normal user behavior;

[0026] C. Rule engine unit, which matches abnormal behaviors based on preset rules (such as access time, resource sensitivity, and operation frequency).

[0027] Furthermore, the rule engine is combined with a machine learning algorithm to dynamically optimize anomaly detection rules through online learning.

[0028] Furthermore, the multi-factor decision of the access decision module includes:

[0029] A. User identity factors: account, role, department, position;

[0030] B. Behavioral risk factors: abnormal behavior type and risk level;

[0031] C. Resource sensitivity factors: resource sensitivity level, operation type (read / modify / delete).

[0032] Furthermore, the access control measures include:

[0033] A. Allow access and record logs;

[0034] B. Limit access time, frequency, or scope of resources;

[0035] C. Access is denied and an account lockout or security alert is triggered.

[0036] Furthermore, the policy update module optimizes the policy through the following feedback mechanism:

[0037] A. User feedback: issues such as misjudgment of collection permissions and inconvenient access;

[0038] B. Security audit: Analyze access logs and identify policy loopholes;

[0039] C. Threat Intelligence: Synchronize new attack methods and update anomaly detection rules.

[0040] Furthermore, the policy update includes:

[0041] A. Rule update: add, modify or delete preset access control rules;

[0042] B. Model update: Use new data to train the machine learning model and optimize the behavioral baseline;

[0043] C. Permission adjustment: Dynamically increase or decrease access permissions based on user behavior.

[0044] After adopting the above method, the present invention has the following advantages: This article proposes a behavior-based dynamic access control strategy, which dynamically adjusts the user's access rights by collecting and analyzing user behavior data in real time to achieve more refined, flexible and secure access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of the behavior collection module of the behavior-based dynamic access control policy system.

[0046] Figure 2 This is a schematic diagram of the behavior analysis module of the behavior-based dynamic access control policy system.

[0047] Figure 3 This is a schematic diagram of the access decision module of the behavior-based dynamic access control policy system.

[0048] Figure 4 This is a schematic diagram of the policy update module of the behavior-based dynamic access control policy system. DETAILED DESCRIPTION

[0049] The present invention will be described in further detail below with reference to the accompanying drawings.

[0050] Combined with attachment Figure 1-4 ,A behavior-based dynamic access control policy system.

[0051] The concept and necessity of behavior-based dynamic access control strategy

[0052] Concept: A behavior-based dynamic access control policy collects and analyzes user behavior data in real time, dynamically assesses user access rights, and adjusts user access rights to resources based on the assessment results. This policy focuses on user behavior and uses it as the basis for access control. By monitoring and analyzing user behavior in real time, it identifies patterns and potential risks, thereby achieving fine-grained control over user access.

[0053] In a behavior-based dynamic access control policy, user behavior data includes login information, operation history, resources accessed, access time, access frequency, and the device used. By analyzing this behavior data, we can understand the user's normal and abnormal behavior patterns, thereby determining the legitimacy and safety of the user's access request. If the user's behavior conforms to normal behavior patterns, access to the corresponding resources is permitted. If the user's behavior exhibits abnormal characteristics, appropriate access control measures are implemented based on the severity of the anomaly and the risk level, such as access restriction, access denial, and logging.

[0054] necessity:

[0055] 1. Responding to complex and changing security threats

[0056] As cyberattacks become increasingly diverse and intelligent, attackers may exploit legitimate users' identities to gain unauthorized access or conduct malicious operations. Traditional identity- and role-based access control strategies struggle to effectively identify and prevent such attacks. However, behavior-based dynamic access control strategies can monitor and analyze user behavior in real time, promptly identifying abnormal behavior and enabling appropriate security measures to improve system security and reliability.

[0057] 2. Adapt to changes in user behavior patterns

[0058] User behavior patterns may change over time, depending on the environment and business needs. For example, a user may primarily access work-related resources during normal working hours, but may access entertainment resources during off-hours. Traditional access control policies cannot dynamically adjust access rights based on changes in user behavior patterns. However, behavior-based dynamic access control policies can track user behavior changes in real time and adjust access rights based on the user's latest behavior patterns, thereby better meeting the user's actual needs.

[0059] 3. Implement fine-grained access control

[0060] Traditional access control policies typically only implement coarse-grained access control. For example, role-based access control can only assign users to different roles, each with corresponding access permissions, and cannot provide fine-grained control over specific user operations. However, behavior-based dynamic access control policies can implement fine-grained control over user access behavior based on specific user actions (such as read, modify, and delete operations), as well as the sensitivity and importance of the accessed resources, thereby better protecting important resources in the system.

[0061] An overall framework for behavior-based dynamic access control policies

[0062] The overall framework of the behavior-based dynamic access control strategy includes four main modules: behavior collection module, behavior analysis module, access decision module and policy update module.

[0063] (1) Behavior Collection Module

[0064] The behavior collection module is the foundation of the entire strategy. It is responsible for collecting various user behavior data to provide data support for subsequent behavior analysis and access decision-making. User behavior data includes login information, operation records, accessed resources, access time, access frequency, and the device used.

[0065] Types of data collected

[0066] Login information: This includes the user's login time, login IP address, device type (e.g., PC, mobile phone, tablet), device MAC address, operating system version, etc. This information can be used to determine the user's login location, the legitimacy of the login device, and any abnormal login behavior.

[0067] Operation records: These include various user operations within the system, such as reading, modifying, deleting, and creating files; querying, inserting, updating, and deleting databases; and modifying system settings. These operation records can be used to analyze user behavior patterns and operation intentions, and determine whether the user has legitimate operation permissions.

[0068] Accessed resources: This includes the names, paths, types, and sensitivity levels of files, database tables, web pages, applications, and other resources accessed by users. This information can be used to determine whether the resources accessed by users match their identity and permissions, as well as the sensitivity and importance of the resources.

[0069] Access time: This includes the specific time when a user accesses a resource, such as year, month, day, hour, minute, and second. Access time can be used to analyze user access habits and determine whether accessing resources during non-working hours is abnormal behavior.

[0070] Access frequency: This includes the number of times a user accesses a resource within a certain period of time, the time interval between accesses, etc. Access frequency can be used to determine whether a user has abnormal behavior of frequently accessing a resource, such as brute force cracking in malicious attacks.

[0071] Device used: This includes hardware information (such as CPU model, memory size, hard drive capacity, etc.), software information (such as installed applications, browser version, etc.), and network connection information (such as network type and speed). This information can be used to determine whether the device used by the user is secure and whether it contains malware or vulnerabilities.

[0072] Collection methods and techniques

[0073] Logging: By adding logging functionality to various system components, various user behavior data can be recorded. For example, login and operation logs can be recorded in the operating system; access and operation logs can be recorded in applications; and query and update logs can be recorded in databases. Logging is a common method for collecting behavioral data, offering advantages such as simplicity, convenience, and low cost. However, it is important to ensure the integrity and accuracy of the logs, as well as their storage and management.

[0074] Sensors: Deploy sensors at key locations within the system, such as network sensors, host sensors, and application sensors, to monitor user behavior data in real time. Network sensors monitor network data packets and capture user network access behavior; host sensors monitor host system status, process activity, and file operations; and application sensors monitor application status and user behavior. While sensor-based data collection offers advantages such as high real-time performance and accurate data, it requires significant costs and technical support.

[0075] APIs: This interface allows for data exchange with other systems or applications through APIs to obtain user behavior data. For example, integration with identity authentication systems, log management systems, and security audit systems can be used to obtain user login information, operation history, and other data. While API collection offers advantages such as high integration and convenient data sharing, it is important to consider the security and stability of the interface.

[0076] Ensuring data integrity and accuracy

[0077] To ensure the integrity and accuracy of the collected behavioral data, the following measures need to be taken:

[0078] Data Verification: Verify the collected data to check whether it is complete, formatted correctly, and logically consistent. For example, verify the legitimacy of the login IP address and the accuracy of the timestamp in the operation record.

[0079] Data encryption: Encrypt collected data to prevent it from being stolen or tampered with during transmission and storage. For example, use encryption algorithms to encrypt and store log data, and use secure transmission protocols (such as HTTPS, SSL, etc.) to transmit data.

[0080] Data backup: Collected data is backed up regularly to prevent data loss. Backup data can be stored on local storage devices or cloud storage platforms to ensure timely recovery in the event of data loss.

[0081] (2) Behavior Analysis Module

[0082] The behavior analysis module is the core of the entire strategy. It processes and analyzes collected behavioral data, identifying user behavior patterns and potential risks, and providing decision-making basis for the access decision module. The behavior analysis module can use machine learning algorithms, rule engines, and other technologies to analyze and mine user behavior data.

[0083] Data preprocessing

[0084] Before conducting behavioral analysis, the collected behavioral data needs to be preprocessed, including data cleaning, data integration, data conversion, data reduction and other steps.

[0085] Data cleaning: Remove noise, duplicate data, and missing data to improve data quality. For example, delete invalid records in logs and fill in missing timestamps.

[0086] Data integration: Integrate behavioral data from different data sources to resolve data conflicts and redundancies. For example, user behavior data from operating system logs, application logs, and database logs can be integrated to form a unified user behavior data set.

[0087] Data conversion: Convert data into a format and form suitable for analysis, such as converting character data into numeric data, converting time data into timestamps, etc.

[0088] Data reduction: Reduce the size and dimensionality of data through methods such as data compression and feature selection to improve analysis efficiency. For example, principal component analysis (PCA) can be used to reduce the dimensionality of high-dimensional data.

[0089] Behavioral pattern recognition

[0090] Behavioral pattern recognition analyzes user behavior data to identify normal and abnormal behavior patterns. Machine learning algorithms, such as cluster analysis and anomaly detection, can be used to analyze and model user behavior data.

[0091] Cluster analysis: Cluster user behavior data based on similarities to form distinct behavior clusters. Each behavior cluster represents a user behavior pattern, such as access during normal working hours or access for entertainment during off-hours. Cluster analysis can help us understand the primary user behavior patterns and provide a foundation for subsequent anomaly detection.

[0092] Anomaly detection: This approach builds a normal behavior model to detect whether user behavior deviates from normal patterns. Common anomaly detection algorithms include statistical methods, support vector machines (SVMs), and neural networks. For example, statistical methods are used to calculate statistical quantities such as the mean and variance of user behavior data. When user behavior data falls outside the normal range, it is considered abnormal.

[0093] Rules Engine

[0094] The rule engine is a behavioral analysis technology based on preset rules. It can match and judge user behavior data based on predefined rules. Rules can include factors such as the user's access time, access frequency, resource sensitivity, and operation type. For example, if the preset rule "If a user frequently accesses sensitive resources (such as financial data) during non-business hours (such as 10 pm to 6 am), this is considered abnormal behavior," when the user's behavior data meets this rule, the rule engine will trigger the corresponding exception handling mechanism.

[0095] Rules need to be defined and maintained by security administrators or experts based on specific application scenarios and security requirements. While rule engines offer advantages such as simplicity, intuitiveness, and ease of understanding and maintenance, they also have drawbacks such as limited rule coverage and difficulty adapting to complex behavioral patterns. Therefore, in practical applications, rule engines are often combined with machine learning algorithms to improve the accuracy and effectiveness of behavioral analysis.

[0096] (3) Access decision module

[0097] The access decision module determines whether to grant access to resources based on the analysis results of the behavior analysis module, combined with factors such as user identity information and resource permissions. The access decision module can use a multi-factor decision-making approach to improve the accuracy and security of its decisions.

[0098] Decision Factors

[0099] User identity information: This includes user account, role, department, position, etc. User identity information is the basic basis for access control, and users with different identities have different access rights.

[0100] Behavior analysis results: This includes information such as whether the user's behavior patterns are normal, whether there are any abnormal behaviors, and the risk level of abnormal behavior. Behavior analysis results are an important basis for dynamically adjusting user access rights. When a user's behavior exhibits abnormal characteristics, access rights need to be adjusted based on the degree of abnormality and risk level.

[0101] Resource permission requirements: This includes the resource's sensitivity level, the type of access operation (such as read, modify, delete), and the scope of users allowed access. Different resources have different permission requirements, and you need to develop appropriate access control policies based on the importance and sensitivity of the resource.

[0102] Decision-making methods

[0103] Multi-factor decision-making: This approach comprehensively considers multiple factors, including user identity information, behavioral analysis results, and resource permission requirements, and uses methods such as weighted scoring, decision trees, and fuzzy logic to make decisions. For example, each decision factor is assigned a certain weight, and a comprehensive score is calculated based on the user's actual situation. When the comprehensive score reaches a certain threshold, the user is allowed access to the corresponding resource; otherwise, access is denied.

[0104] Real-time decision-making: The access decision module must process user access requests in real time and make rapid access decisions based on the latest behavioral analysis results and resource permission requirements. To improve decision-making efficiency, caching and indexing technologies can be used to quickly query and retrieve data such as user identity information, behavioral analysis results, and resource permission requirements.

[0105] Access control measures

[0106] Based on the results of the access decision, take corresponding access control measures, including allowing access, restricting access, denying access, and recording logs.

[0107] Allow access: When a user's access request is legal and safe, the user is allowed to access the corresponding resources and the access log is recorded.

[0108] Access Restriction: When a user's behavior exhibits certain abnormal characteristics but the risk level is low, you can restrict the user's access rights, such as limiting access time, access frequency, and the scope of resources accessed. For example, users accessing sensitive resources during off-hours can be restricted to read only, with no modification or deletion allowed.

[0109] Deny access: When a user's behavior exhibits serious abnormal characteristics or poses a high security risk, the user's access request will be denied and a denial log will be recorded. At the same time, further security measures can be taken, such as locking the user account and notifying the security administrator.

[0110] Record logs: All user access requests and decision results are recorded for subsequent security audits and analysis.

[0111] (4) Policy Update Module

[0112] The policy update module adjusts access control policies in a timely manner based on actual access conditions and security incidents to ensure policy effectiveness and adaptability. The policy update module needs to establish a feedback mechanism to collect user feedback, security audit results, new security threats, and other information to dynamically update and optimize policies.

[0113] Feedback mechanism

[0114] User feedback: Collect user feedback on access control policies and understand the problems and inconveniences users encounter during use, such as insufficient access rights and misjudgments. Based on user feedback, adjust and optimize policies to improve user satisfaction and experience.

[0115] Security Audit: Regularly audit system access logs and operation records to analyze security risks and vulnerabilities in the system and evaluate the effectiveness and security of access control policies. Based on the security audit results, policies are adjusted and improved to fix security vulnerabilities and improve system security.

[0116] New security threats: Monitor the latest security threats and attack methods, and promptly update the abnormal behavior detection rules and risk assessment models in the strategy to address new security challenges. For example, when a new network attack method emerges, promptly add corresponding detection rules to the rule engine to improve the system's prevention capabilities.

[0117] Policy Update Method

[0118] Rule updates: Update and maintain the pre-set rules in the rule engine, adding new rules, modifying existing rules, or deleting outdated rules. Rule updates must undergo rigorous testing and verification to ensure their correctness and effectiveness.

[0119] Model Update: Update and optimize the behavior model built by the machine learning algorithm. Use new behavior data to train the model to improve its accuracy and adaptability. Model updates can be performed using online or offline learning, with the appropriate update strategy selected based on the actual situation.

[0120] Permission Adjustment: Dynamically adjust user access permissions based on user behavior and security requirements. For example, for users who demonstrate good behavior, their access permissions can be appropriately increased; for users with abnormal behavior, their access permissions can be reduced or revoked based on the severity of the anomaly and the risk level.

[0121] Advantages of behavior-based dynamic access control policies

[0122] (1) Real-time dynamic adjustment of access rights

[0123] Behavior-based dynamic access control policies collect and analyze user behavior data in real time, dynamically adjusting access permissions based on real-time user behavior. Compared to traditional access control policies, they no longer rely on static user identity and role information. Instead, they dynamically authorize users based on their actual behavior, better adapting to complex and changing network environments and user behavior patterns. For example, if a user demonstrates legitimate access behavior during normal working hours, access to the corresponding resources is permitted; if a user frequently accesses sensitive resources during non-working hours, access is promptly restricted or denied, improving system security.

[0124] (2) Fine-grained access control

[0125] This policy enables fine-grained control of user access behavior based on specific user actions, such as read, modify, and delete operations, as well as the sensitivity and importance of the resources being accessed. Traditional access control policies typically only implement coarse-grained access control. For example, role-based access control can only assign users to different roles, each with corresponding access permissions, without providing fine-grained control over specific user operations. However, a behavior-based dynamic access control policy can make more refined access decisions for each access request, combining user behavior data with resource permission requirements, thereby better protecting important resources in the system.

[0126] (3) Improving security detection and prevention capabilities

[0127] Real-time monitoring and analysis of user behavior data can promptly identify abnormal behavior and potential security threats, improving the system's security detection and prevention capabilities. Traditional access control strategies rely primarily on identity authentication and authorization, making it difficult to effectively identify and prevent unauthorized access and malicious operations exploiting legitimate user identities. However, behavior-based dynamic access control strategies can establish a model of normal user behavior and detect deviations from normal patterns. This allows for the timely detection of abnormal behavior, such as account theft and malicious attacks, and the implementation of appropriate security measures, such as access restrictions, access denials, and logging, to prevent the occurrence and escalation of security incidents.

[0128] (4) Adapting to complex business needs

[0129] In enterprise and organizational information systems, business requirements are often complex and ever-changing, and different users may require different access rights at different times and in different scenarios. Behavior-based dynamic access control policies can dynamically adjust access rights based on user behavior, better adapting to complex business needs. For example, in project collaboration, different project members may need to dynamically obtain appropriate access rights based on their roles and tasks within the project. In mobile office scenarios, when users access the system using different devices, access rights need to be dynamically adjusted based on the device's security and user behavior patterns.

[0130] Challenges of behavior-based dynamic access control strategies

[0131] 1. Cost and complexity of data collection

[0132] The behavior collection module needs to collect a large amount of user behavior data, including login information, operation records, and accessed resources. This results in high data collection costs and complexity. On the one hand, it is necessary to add logging capabilities or deploy sensors in various system components, which requires technical support and resource investment. On the other hand, the collected data may come from different data sources with different formats and structures, requiring preprocessing such as data cleaning, integration, and conversion, which increases the difficulty and cost of data processing.

[0133] (2) Accuracy and efficiency of behavioral analysis

[0134] The behavioral analysis module needs to analyze and process large amounts of behavioral data to identify user behavior patterns and potential risks. However, user behavior is diverse and complex. Different users may have different behavioral patterns, and the same user's behavior may also change at different times and in different scenarios. Therefore, improving the accuracy and efficiency of behavioral analysis is a key issue. Although machine learning algorithms can automatically learn user behavior patterns, they require a large amount of training data and computing resources. Moreover, training and updating the model takes a certain amount of time and may not be able to respond to new behavior patterns and security threats in a timely manner. Although the rule engine is simple and intuitive, the definition of rules requires manual intervention, the coverage of the rules is limited, and it is difficult to adapt to complex behavior patterns.

[0135] (3) Privacy protection and data security

[0136] The collection and analysis of user behavior data involves personal privacy and sensitive data, such as login IP addresses, device information, and resource content accessed. Protecting user privacy and data security is a critical issue. Effective data encryption, access control, and data desensitization technologies are necessary to ensure the security and privacy of user behavior data during transmission, storage, and processing, preventing data leakage or misuse.

[0137] (IV) Balancing the dynamics and stability of strategies

[0138] Behavior-based dynamic access control policies require real-time adjustments to access permissions based on user behavior to achieve dynamic access control. However, the dynamic nature of policies can compromise system stability. For example, frequent permission adjustments can cause inconvenience to users and even cause system anomalies. Therefore, it's important to strike a balance between policy dynamism and stability, ensuring that policy adjustments are reasonable and appropriate, without significantly impacting system performance and user experience.

[0139] Application of behavior-based dynamic access control strategies in different scenarios

[0140] (1) Intranet

[0141] Within an enterprise's internal network, behavior-based dynamic access control policies can be used to protect core enterprise data and resources, such as financial data, customer information, and R&D results. By collecting and analyzing employee behavioral data, such as login time, files accessed, and operation records, employee access rights can be dynamically adjusted. For example, for employees who frequently access sensitive resources, their access behavior can be monitored and controlled more effectively. For employees accessing important resources outside of working hours, identity verification and behavior review are required to ensure the legality and security of their access.

[0142] (2) Cloud computing platform

[0143] In cloud computing platforms, access control for tenants and users is a critical security issue. Behavior-based dynamic access control policies can be used to monitor and control tenant and user access behavior in real time, preventing unauthorized access and data leakage. By collecting tenant and user behavioral data, such as cloud services used, virtual machines accessed, and data operation records, we analyze their behavior patterns and potential risks, and dynamically adjust their access rights to cloud resources. For example, if a tenant suddenly increases their cloud resource usage, we need to check for abnormal behavior, such as malicious attacks or resource abuse, and adjust their access rights based on the inspection results.

[0144] (3) Mobile Applications

[0145] In mobile applications, users access applications using different mobile devices, each with its own unique security features and user behavior patterns. Behavior-based dynamic access control policies can be used to dynamically adjust user access rights to mobile applications based on the device and behavior data used. For example, users accessing applications from unverified devices can have their access to sensitive functions restricted. Users frequently logging in from different locations can also be required to undergo secondary authentication to ensure their identity is legitimate.

[0146] (4) Internet of Things (IoT)

[0147] The IoT connects a vast number of smart devices, posing significant challenges to their security and access control. Behavior-based dynamic access control policies can monitor and control the access behavior of smart devices, preventing malicious devices from accessing and launching attacks. By collecting behavioral data from smart devices, such as communication frequency, data transmission content, and operational instructions, we analyze their behavior patterns and security, and dynamically adjust their access rights to IoT resources. For example, for smart devices exhibiting abnormal communication behavior, such as frequently sending large amounts of data or sending unknown instructions, access can be promptly restricted or blocked, ensuring the secure operation of the IoT system.

[0148] A behavior-based dynamic access control strategy addresses the shortcomings of traditional access control strategies. By collecting and analyzing user behavior data in real time and dynamically adjusting user access rights, it achieves more refined, flexible, and secure access control. This article details the strategy's overall framework, the functions and implementation methods of each module, analyzes the strategy's advantages and challenges, and explores its application in different scenarios.

[0149] Although behavior-based dynamic access control policies face challenges such as data collection costs, behavioral analysis accuracy, and privacy protection, these issues will gradually be addressed with the continuous development of information technology and in-depth research. In the future, they can be further integrated with new technologies such as artificial intelligence and big data to improve the accuracy and efficiency of behavioral analysis, enhance the functionality and performance of policies, and enable them to play an even more important role in the field of information security.

[0150] The above description of the present invention and its embodiments is non-limiting, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by the above, and does not deviate from the purpose of the invention, without creatively designing a structure and embodiment similar to the technical solution, they shall fall within the scope of protection of the present invention.

Claims

1. A behavior-based dynamic access control policy system, characterized by: It includes A. Behavior collection module, used to collect user behavior data in real time, including login information, operation records, access resources, access time, access frequency and device information; B. Behavior analysis module, used to pre-process the collected behavior data, identify behavior patterns and detect anomalies, and generate behavior analysis results; C. Access decision module, which dynamically generates access control decisions based on user identity information, behavior analysis results, and resource permission requirements; D. Policy update module, updates access control policies in real time based on security audit results, user feedback and new threat information.

2. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The behavior collection module collects data in the following ways: A. Logging: Deploy logging functions in the operating system, applications, and databases to record user logins, operations, and access logs; B. Sensors: Monitor network traffic, system processes, and application operations in real time through network sensors, host sensors, or application sensors; C. API interface: Connect with the identity authentication system and log management system through API to obtain user behavior data.

3. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The behavior collection module ensures data integrity and security through data verification, encrypted transmission (such as HTTPS / SSL) and regular backup.

4. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The behavior analysis module includes: A. Data preprocessing unit, used to remove noise, fill missing values, and unify data formats; B. Behavior modeling unit, which uses cluster analysis and anomaly detection algorithms (such as statistical methods, SVM, neural networks) to establish a baseline of normal user behavior; C. Rule engine unit, which matches abnormal behaviors based on preset rules (such as access time, resource sensitivity, and operation frequency).

5. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The multi-factor decision of the access decision module includes: A. User identity factors: account, role, department, position; B. Behavioral risk factors: abnormal behavior type and risk level; C. Resource sensitivity factors: resource sensitivity level, operation type (read / modify / delete).

6. The behavior-based dynamic access control policy system according to claim 5, characterized in that: The access control measures include: A. Allow access and record logs; B. Limit access time, frequency, or scope of resources; C. Access is denied and an account lockout or security alert is triggered.

7. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The policy update module optimizes the policy through the following feedback mechanism: A. User feedback: issues such as misjudgment of collection permissions and inconvenient access; B. Security audit: Analyze access logs and identify policy loopholes; C. Threat Intelligence: Synchronize new attack methods and update anomaly detection rules.

8. The behavior-based dynamic access control policy system according to claim 1, characterized in that: The policy update includes: A. Rule update: add, modify or delete preset access control rules; B. Model update: Use new data to train the machine learning model and optimize the behavioral baseline; C. Permission adjustment: Dynamically increase or decrease access permissions based on user behavior.

Images