Enterprise data security access control method and system

Abstract

The application provides an access control method and system for enterprise data security, and relates to the technical field of node security. The identity information and access information of a user are determined in response to an access request of the user. The initial permission range of the user is determined according to the preset corresponding relationship between the identity information and the permission information, and the permission range includes at least one kind of permission information corresponding to the identity information. The degree of correspondence between the access information and the preset access information is determined. If the degree of correspondence is lower than the degree threshold, the initial permission range is adjusted to the minimum permission range. After receiving the access request of the user, the identity information and access information of the user are obtained. If the access information of the user does not match the preset access information, it is considered that the access environment of the user is not safe, and the access permission of the user is limited, so that the protection of enterprise data is better implemented.

Description

Technical Field

[0001] This application relates to the field of node security technology, and in particular to an access control method and system for enterprise data security. Background Technology

[0002] In today's information age, enterprise data security has become a core pillar of organizational operation and development, and its importance is self-evident. As the value of data continues to increase, protecting data from unauthorized access and leakage has become a crucial aspect of enterprise management that cannot be ignored. Generally, enterprise data is stored across multiple nodes, and the security of this data at each node not only concerns the protection of the enterprise's core assets but also directly impacts business continuity and market competitiveness.

[0003] However, current data security protection methods still have significant shortcomings. Many traditional solutions rely on fixed access control methods, which are difficult to adapt to complex enterprise environments and diverse user needs. This approach can easily lead to inaccurate permission allocation, allowing some users to obtain permissions beyond their actual needs, thus creating security vulnerabilities. Summary of the Invention

[0004] In view of this, this application provides an access control method for enterprise data security. Its main purpose is to dynamically adjust the user's access permissions based on the user's actual identity information and access information when accessing the node, so that the information accessed by the user can be displayed in a relatively secure environment.

[0005] To achieve the above objectives, the first aspect of this application discloses an access control method for enterprise data security, characterized by comprising:

[0006] In response to a user's access request, the system determines the user's identity information and access information, including the user's access time, access device, and access network.

[0007] Based on the preset correspondence between the identity information and the permission information, the user's initial permission range is determined, and the permission range includes at least one of the permission information corresponding to the identity information;

[0008] Determine the degree of consistency between the access information and the preset access information;

[0009] If the degree of conformity is lower than the degree threshold, the initial permission range is adjusted to the minimum permission range.

[0010] A second aspect of this application provides an access control system for enterprise data security, comprising:

[0011] The first determining module is used to determine the user's identity information and access information in response to the user's access request, wherein the access information includes the user's access time, access device, and access network;

[0012] The second determining module is used to determine the user's initial permission range based on the preset correspondence between the identity information and permission information, wherein the permission range includes at least one of the permission information corresponding to the identity information;

[0013] The third determining module is used to determine the degree of consistency between the access information and the preset access information;

[0014] An adjustment module is used to adjust the initial permission range to the lowest permission range if the degree of conformity is lower than the degree threshold.

[0015] A third aspect of this application provides an electronic device, comprising:

[0016] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any of the methods disclosed in the first aspect.

[0017] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0018] In summary, according to the technical solution disclosed in this application, an access control method for enterprise data security is disclosed, comprising: responding to a user's access request, determining the user's identity information and access information, wherein the access information includes the user's access time, access device, and access network; determining the user's initial permission range according to a preset correspondence between the identity information and permission information, wherein the permission range includes at least one permission information corresponding to the identity information; determining the degree of consistency between the access information and the preset access information; and if the degree of consistency is lower than a threshold, adjusting the initial permission range to the minimum permission range. This application can obtain the user's identity information and access information after receiving the user's access request. If the user's access information does not match the preset access information, it can be considered that the user's access environment is insecure, and the user's access permissions can be restricted, thereby better protecting enterprise data.

[0019] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart of an access control method for enterprise data security provided in an embodiment of this application is shown;

[0023] Figure 2 This paper illustrates a structural diagram of an enterprise data security access control system provided in an embodiment of this application. Detailed Implementation

[0024] To better understand the above-mentioned objectives, features, and advantages of this application, the solution of this application will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0025] To address the issue of inaccurate permission allocation, which may grant some users permissions beyond their actual needs and thus create security vulnerabilities, this application provides the following embodiments to solve the above problems:

[0026] This embodiment provides an access control method for enterprise data security, such as... Figure 1 The diagram shown is a flowchart of the method in this embodiment. The method in this embodiment may specifically include the following steps:

[0027] Step 101: In response to the user's access request, determine the user's identity information and access information, including the user's access time, access device, and access network.

[0028] Step 102: Determine the user's initial permission range based on the preset correspondence between identity information and permission information. The permission range includes at least one permission information corresponding to the identity information.

[0029] Based on user identity information obtained from the enterprise's internal identity management system, and in conjunction with a pre-established role and permission mapping table, each user's identity information is matched one by one to obtain the user's initial permission scope. The mapping table stores the correspondence between roles and permissions; by comparing identity information with the data in the table, the user's initial permission scope is determined.

[0030] For example, in an enterprise internal access control scenario, suppose we need to assign access permissions to an employee. First, we retrieve the employee's role identifier from the identity management system, assuming their role is "Department Manager." Using a pre-established role-permission mapping table, we can find that the "Department Manager's" permissions include initial permissions such as viewing department reports and editing project plans. This mapping table stores the correspondence between roles and permissions; for example, a "Department Manager" can access medium-level sensitive data, while a "regular employee" is limited to low-level sensitive data. By comparing the role identifier with the data in the table, we initially determine that the employee can access medium-level access resources.

[0031] For example, after determining the initial scope of permissions, further verification is needed by combining the sensitivity level labels of the target data. Suppose a departmental financial report has a sensitivity level label of "highly sensitive," while the correspondence between identity information and permission information stipulates that the "department manager" role can only access data of "medium sensitivity" and below. By comparing the sensitivity level labels with the matrix thresholds item by item, it is found that the sensitivity level of this report is higher than the threshold for the "department manager" role, therefore it is marked as restricted access, ultimately forming an access restriction list.

[0032] For example, in determining the final scope of permissions, the initial scope of permissions is cross-validated against the access restriction list. A logical comparison is performed between each permission category and the restricted data. For instance, if the initial permissions for a "department manager" include access to all department reports, but the restriction list indicates that highly sensitive financial statements are inaccessible, the final scope of permissions will exclude that data, retaining only access to medium- and lower-level sensitive reports.

[0033] In one possible implementation, the sensitivity threshold matrix can be dynamically adjusted according to enterprise needs. For example, the threshold for "highly sensitive" data can be subdivided into multiple sub-levels, and differentiated access restrictions can be set for different department managers. This approach enhances the flexibility of access management and adapts to the complex data protection needs within an enterprise.

[0034] For example, thresholds can be relaxed for finance department managers, while strict limits remain for managers in other departments, thus striking a balance between security and efficiency. The beneficial effect of this design is that it both ensures data security and improves the business execution efficiency of specific roles.

[0035] In one possible implementation, the generation of the access restriction list can be optimized by incorporating historical access records. For example, if an employee has frequently requested access to highly sensitive data but has been denied, the system can automatically prompt the administrator whether to adjust their role permissions or data tags. This feedback mechanism helps to continuously improve access management strategies, reduce unnecessary restrictions, enhance employee work experience, and also provides the enterprise with a basis for permission allocation decisions, thus enhancing the system's intelligence level.

[0036] Step 103: Determine the degree of consistency between the access information and the preset access information.

[0037] Step 104: If the degree of conformity is lower than the degree threshold, adjust the initial permission range to the lowest permission range.

[0038] In some embodiments, if the degree of conformity is lower than a degree threshold, adjusting the initial permission range to the lowest permission range includes:

[0039] If the degree of matching is lower than the threshold, determine the initial verification information corresponding to the identity information; based on the initial verification information, determine the actual verification information, the information security level of the actual verification information is higher than the information security level of the initial verification information; determine whether the user has passed the verification of the actual verification information; if the user has not passed the verification of the actual verification information, adjust the initial permission range to the minimum permission range.

[0040] In some embodiments, the access request includes: high-level permission information, which exceeds the scope of the initial permission;

[0041] After determining the degree of consistency between the access information and the preset access information, the method further includes:

[0042] If the degree of conformity is greater than or equal to the degree threshold, the initial permission range is adjusted to a temporary permission range. The permission level of the temporary permission range is higher than that of the initial permission range, and the temporary permission range contains higher-level permission information.

[0043] In some embodiments, if the degree of conformity is greater than or equal to a degree threshold, adjusting the initial permission range to a temporary permission range includes:

[0044] If the degree of matching is greater than or equal to the degree threshold, determine the initial verification information corresponding to the identity information; based on the initial verification information, determine the actual verification information, the information security level of the actual verification information is higher than the information security level of the initial verification information; determine whether the user has passed the verification of the actual verification information; if the user has passed the verification of the actual verification information, adjust the initial permission range to the temporary permission range.

[0045] Access information for the current access request is obtained from the request log. This information includes access time, device identifier, and network location. A pre-established log parsing tool is used to structure this information, resulting in a complete context dataset. This context dataset is then matched against preset security rules using a policy comparison tool. If at least one attribute deviates from a preset threshold, the verification strength is increased, generating a corresponding trigger signal. Based on this trigger signal, an additional authentication request is pushed through a multi-factor authentication module. This request combines the dynamic characteristics of the device identifier and network location to obtain secondary verification data for the user, determining if the verification data meets the requirements. The verification results are compared with a preset permission level mapping table. A permission allocation tool dynamically adjusts the permission level based on the verification results, resulting in the final access permission configuration.

[0046] For example, in enterprise internal access control scenarios, access information obtained from request logs can be structured using log parsing tools to process data such as access time, device identifier, and network location. Suppose an employee initiates an access request from an unregistered device outside of working hours, such as 2:00 AM. The log parsing tool will extract this information into structured data, including timestamps, unique device identifiers, and the geographical location of the IP address. This data provides the foundation for subsequent security policy comparisons.

[0047] For example, when matching contextual datasets against preset security rules, rules can be set requiring access to occur between 8:00 AM and 6:00 PM on weekdays, the device to be a registered enterprise device, and the network location to be within the company's office area. If the parsed data indicates an access time of 2:00 AM, a device identifier not in the company's device database, and an IP address indicating a login from a different location, the policy comparison tool will determine that these attributes deviate from the thresholds, triggering a signal to increase verification strength. This method can promptly identify abnormal access behavior.

[0048] For example, after the trigger signal is generated, the multi-factor authentication module pushes additional authentication requests based on the dynamic characteristics of the device identifier and network location. If the system detects a login from a different location, it will send the user a dynamic verification code via SMS and require the user to complete biometric verification, such as fingerprint scanning, through an internal enterprise application. Only when both verifications pass will the system consider the secondary verification data acceptable. This multi-layered authentication method significantly improves access security.

[0049] For example, during the dynamic adjustment of permission levels, the permission allocation tool compares the verification results with a preset permission level mapping table. Suppose the mapping table specifies that users who complete multi-factor authentication can obtain temporary high-level permissions, while users who fail authentication will have their permissions downgraded to read-only mode. If a user passes all verifications, the system will dynamically adjust their permissions, allowing access to sensitive data; conversely, if verification fails, permissions will be restricted to the lowest level. This dynamic adjustment mechanism can flexibly address security needs in different scenarios. For example...

[0050] Specifically, dynamic feature analysis of network location can determine whether a user is within a trusted area using an IP address database. Assuming the IP range of a company's office area is 192.168.1.0 to 192.168.1.255, if a user logs in using an external IP address, such as 203.0.113.5, the system will mark it as high-risk and further evaluate it based on other access information. This meticulous analysis helps to accurately identify potential threats. For example...

[0051] It's worth noting that when processing access information, the log parsing tool prioritizes extracting key fields, such as access time and device identifier, to ensure efficient data processing. Assuming a daily log volume of 100,000 entries, the tool will use preset filtering rules to retain only records related to security policies, reducing system load.

[0052] In some embodiments, the minimum permission range or the temporary permission range of the access information is used as the final permission range. After adjusting the initial permission range of the access information to the final permission range of the access information, the access information method further includes:

[0053] Obtain user access data, including access node, access time, and operation type; determine the access risk value based on the access data; if the access risk value is higher than the risk threshold, execute the permission restriction command.

[0054] In some embodiments, the access information accesses data based on the access information to determine the access risk value of the access information accessing the data, including:

[0055] A path transparency analysis algorithm is used to determine access flow information by combining access information access nodes and access time. The access flow information is compared with the preset legal flow information to determine whether the access information access data is legal. If the access information access data is illegal, the target node is determined and the access information target node is an illegal access node. A risk timely identification model is used to determine the access risk value when the access information access data accesses the access information target node.

[0056] In some embodiments, a risk identification model is used to determine the access risk value when accessing data to a target node, including:

[0057] Using a timely risk identification model, determine the operation type when accessing data to the target node; obtain historical operation types and determine the access risk value when accessing data to the target node based on the deviation value between the operation type and the historical operation type.

[0058] Based on the characteristics of data storage and transmission nodes, a tracking agent module is deployed to monitor the data movement process during cross-system movement, obtain key data from the flow log, and obtain preliminary path information from the source system to the target system. By parsing the flow log and combining it with access permission level restrictions, it is determined whether the data movement conforms to preset permission rules. If it does not conform to the preset permission rules, abnormal path information is marked, and the trajectory record of the abnormal data flow is determined. Using a real-time recording method, the abnormal path information is compared and analyzed with the normal path information to extract the timestamp and location data from the transmission nodes, thereby obtaining the complete trajectory record.

[0059] For example, in enterprise internal data security management scenarios, given the characteristics of data storage and transmission nodes, a tracking agent module can be deployed to monitor the cross-system movement of data. A tracking agent module can be understood as an embedded monitoring tool specifically designed to capture key information about data flow between different systems, such as source system identifiers, target system addresses, and transmission times. This module is typically deployed at critical nodes along the data flow path to ensure complete recording of data movement.

[0060] For example, in the process of parsing workflow logs, specialized log analysis tools can be used to extract key data. Suppose that during a data migration, an internal enterprise system records log information about data moving from the core database to a backup server, including fields such as timestamp 2023-10-15 14:30:00, source system DB-01, and target system Backup-02. The parsing tool will structure this information and compare it against access permission level restrictions to determine whether it conforms to preset rules, such as whether the data migration was limited to a specific time period or between specific systems.

[0061] For example, in determining whether data movement complies with access control rules, suppose the preset rules require data to be migrated only between 8:00 AM and 6:00 PM during working hours, and the target system must be an authorized internal device. If the analysis results show that the data migration occurred at 1:00 AM, or the target system is not an authorized device, the system will mark it as abnormal path information. This marking helps to subsequently track the trajectory of abnormal data flow and clarify the specific node and time when the problem occurred.

[0062] For example, for recording and comparing abnormal path information, complete trajectory data can be obtained through real-time recording. Suppose a normal path requires data to be transmitted directly from DB-01 to Backup-02, while an abnormal path shows that the data passes through an unauthorized intermediate node, such as Temp-03. The system will extract the timestamp and location data from the abnormal path to form a complete trajectory record from DB-01 to Temp-03 and then to Backup-02. This comparative analysis can clearly show the deviations in the data flow.

[0063] For example, in extracting timestamps and location data from transmission nodes, more detailed analysis can be performed using the time and system identifier fields in the logs. Suppose the log of an abnormal data transfer shows that data was sent from DB-01 at 01:15:00 on 2023-10-15, arrived at Temp-03 at 01:20:00, and only reached Backup-02 at 01:30:00. Combined with location data analysis, Temp-03 might be located on an external network. This detailed recording helps pinpoint the specific stage of the anomaly.

[0064] For example, regarding the follow-up processing of abnormal trajectory records, this information can be fed back to the security management platform to trigger corresponding protective measures. If the system detects an external node in the data flow trajectory, it will automatically restrict subsequent data transmission permissions along that path and notify the administrator for manual review. This approach can promptly block potential security risks.

[0065] For example, in extended applications of the overall solution, historical data transfer logs can be used to optimize preset permission rules. Suppose long-term analysis reveals frequent abnormal data transfers within certain time periods; the system can dynamically adjust the rules to further tighten data migration permissions for those periods. This continuous optimization approach can continuously improve the security of data transfer.

[0066] Based on detailed records of the data flow trajectory, the data flow timestamps and key node data are obtained. The key nodes are then ordered by timestamp to determine the initial path sequence of the data flow. Using this initial path sequence and pre-defined compliance rules, rule matching is performed on the access records of the key nodes. If an unauthorized node is detected, it is marked as abnormal behavior, thus obtaining the initial location of the abnormal behavior. Employing a path transparency analysis method, the correlation data between the node location and the data flow trajectory is extracted to determine if there are paths deviating from compliance rules, thereby determining the specific location marker of the abnormal behavior.

[0067] For example, in enterprise internal data security management scenarios, detailed records of data flow can be used to trace the path sequence by analyzing timestamps and key node data. Suppose that in a data migration, records show that data was sent from core server A on October 15, 2023, at 08:00:00, arrived at transit node B at 08:10:00, and finally arrived at target storage C at 08:20:00. By sequentially arranging these timestamps, the initial data flow path can be determined to be from A to B and then to C.

[0068] For example, for compliance rule matching of the initial path sequence, rules can be set to require that data can only be transmitted through authorized nodes.

[0069] In one possible implementation, assuming that the preset rules stipulate that the transit node must be an internal enterprise device, and the inspection finds that node B is not an authorized device, the system will mark B as an abnormal behavior and initially locate the abnormality in the flow link from A to B.

[0070] For example, in the path transparency analysis phase, after initially locating abnormal behavior, the correlation data between node locations and flow trajectories can be further extracted. Suppose that analysis reveals node B's location information indicates it is on an external network, and the flow trajectory shows the data lingers at B for an excessively long time, significantly deviating from compliance path requirements. In this case, the system will mark the specific location of the abnormal behavior as node B and record evidence of its deviation from compliance rules, such as the external network identifier and the abnormal dwell time.

[0071] Specifically, for the implementation of arranging key node timestamps sequentially, the log system can automatically collect time data from each node and generate a path diagram according to the time sequence. Assuming that in a certain flow, the data timestamps at the three nodes are 08:00:00, 08:05:00, and 08:15:00, the system will generate an intuitive path sequence from the start to the end point based on this.

[0072] In one possible implementation, the detection of unauthorized access nodes can be achieved by comparing access records with a permission database. If a node appears for the first time in the access records and is not on the authorized list, the system will automatically mark it as abnormal. This detection mechanism effectively identifies potential risks and ensures the security of data flow. Finally, the implementation of marking the specific location of abnormal behavior can be achieved using trajectory correlation analysis tools to compare node locations with compliant paths. If an abnormal node is found to be located in an unexpected area, the system will generate a detailed report recording its location deviation. The benefit of this transparent analysis is improved accuracy in problem localization, providing strong support for enterprise data security management.

[0073] Step S105: Based on the specific location of the abnormal flow, a risk timely identification model is constructed. By extracting the visitor's role identifier and operation type from the log data of the abnormal location, and comparing and analyzing it with the historical behavior pattern database, it is determined whether it is a malicious operation. If the operation behavior deviates from the historical pattern, a risk alarm message is generated to obtain the classification result of potential threats.

[0074] Log data is extracted from the specific location of the abnormal flow. A pre-established log parsing tool is used to obtain the visitor's role identifier and operation type. These are then preliminarily categorized to obtain preliminary classifications of operation behavior records. Based on these preliminary classifications, a database query tool is used to retrieve historical operation data corresponding to the role identifier from a historical behavior pattern database. This historical data is compared with the current operation type. If the current operation deviates from the historical pattern, it is identified as an abnormal operation behavior record. Using these abnormal operation behavior records, a preset threshold comparison tool is used to quantify the degree of deviation. If the deviation exceeds a preset threshold, it is judged as a potential malicious operation, resulting in a preliminary classification of potential threats.

[0075] For example, in the field of anomaly detection in data flow, the process of extracting log data from anomaly locations can be understood as a fine-grained information mining approach. Log data typically contains information such as the visitor's identity, operation time, and specific operation content. Using pre-established log parsing tools, the visitor's role and operation type can be quickly extracted. Suppose that in an internal enterprise data flow system, an operation log shows that a regular employee accessed core financial data outside of working hours. This role is identified as "regular employee," and the operation type is "data read." Through initial classification, this behavior can be recorded as "unauthorized access," laying the foundation for subsequent analysis.

[0076] For example, comparing preliminary categorized operational behavior records with a historical behavior pattern database can be achieved using database query tools. Suppose the historical behavior pattern database records the operational habits of the "ordinary employee" role over the past year, typically involving routine data queries only between 9:00 AM and 5:00 PM on weekdays. The current operation occurred at 2:00 AM, clearly deviating from the historical pattern and thus being flagged as an abnormal operational behavior record. This comparison method can effectively identify potential non-compliant behaviors, providing a basis for subsequent in-depth analysis.

[0077] For example, when quantitatively assessing the degree of deviation from abnormal operational behavior, a preset threshold comparison tool can be used. Suppose the system sets a deviation threshold of 80%, and analysis reveals that the employee's operation time deviates from historical patterns by 90%, exceeding the preset threshold, and is therefore judged as potentially malicious operation. Further combining the operation type and the importance of the accessed data, this behavior can be preliminarily classified as a "high-risk threat." This quantitative assessment method can intuitively reflect the severity of abnormal behavior and helps to prioritize the handling of high-risk events.

[0078] Specifically, the classification process based on role identification and operation type can be analyzed in detail from multiple perspectives. For example, in addition to the time dimension, it can also be classified according to the sensitivity level of the accessed data. Suppose an employee accesses financial data classified as "highly confidential," but historical records show that their access is limited to "normal data." This mismatch between access and behavior further corroborates the possibility of a potential threat. Through multi-dimensional analysis, the characteristics of abnormal behavior can be more comprehensively portrayed.

[0079] For example, in practical applications, the initial classification results of potential threats can be supplemented and verified by incorporating contextual information. Suppose the system detects that an employee received a suspicious email the day before the abnormal operation, the email containing a data extraction request; this contextual information can serve as supporting evidence to further confirm the malicious nature of the behavior. This multi-faceted analysis not only improves the accuracy of detection but also provides richer decision-making support for subsequent risk management.

[0080] Specifically, the implementation of the above methods can play a crucial role in monitoring the compliance of data flow. By extracting logs, comparing behaviors, and quantitatively assessing the degree of deviation, the entire process forms a closed-loop anomaly detection mechanism. Particularly in enterprise internal data security management, this approach can promptly identify potential threats, reduce the risk of data breaches, and provide detailed data support for subsequent audits and accountability.

[0081] Based on the content of the alarm information, a pre-established classification tool is used to extract the specific threat type and impact range from the alarm information. A preliminary comparison is performed between the threat type and a preset control policy library to obtain at least one matching policy option, thus determining a preliminary policy direction. Based on this preliminary policy direction, a comparison tool is used to perform deep correlation matching between the policy option and the threat type characteristics using detailed rules in the policy library, obtaining the corresponding restrictive measures and determining the applicable instruction generation path. If the restrictive measures involve data access constraints, an instruction generation tool is used to generate a temporary locking operation instruction. The temporary locking instruction is then correlated and adjusted with the permission level to obtain the specific execution plan details.

[0082] For example, in the field of security monitoring of internal enterprise data flow, the process of processing alarm information and matching strategies can be analyzed in detail from multiple perspectives. First, the process of extracting threat types and impact scope from alarm information can be understood as a key step in information classification. Suppose the system receives an alarm indicating that an employee attempted to access sensitive data in an unauthorized area. Using a pre-established classification tool, the threat type can be quickly extracted as "unauthorized access," and the impact scope as "core data modules." This classification method helps to clarify the core of the problem and provides a clear direction for subsequent strategy matching.

[0083] For example, a preliminary comparison between threat types and a pre-defined control policy library can be achieved using a policy matching engine. Assuming the control policy library contains multiple policy options for dealing with unauthorized access, such as "restrict access" or "log and warn," the system will initially filter for "restrict access" as the policy direction based on the threat type. This preliminary comparison can quickly pinpoint the appropriate response, ensuring that subsequent actions are targeted.

[0084] For example, in the deep correlation matching stage, a detailed comparison of the characteristics of the initial strategy direction and threat type can be performed using a rule engine tool. Suppose that detailed rules in the policy library stipulate that for "unauthorized access" affecting "core data modules," a "temporary account lockout" should be implemented. Through comparison tool analysis, the system confirms that the employee's actions conform to this rule, thus generating a temporary lockout instruction path. This deep matching ensures the accuracy of the measures and avoids misjudgment or overreaction.

[0085] For example, when restrictive measures involve data access constraints, the process of generating a temporary lockout instruction can be achieved through an instruction generation tool. Suppose the system generates an instruction to lock an employee's account for 24 hours based on policy rules. Simultaneously, by adjusting permission levels, it confirms that the instruction only affects access to core data modules and not other regular operational permissions, ultimately forming the detailed execution plan. This refined adjustment can balance security and business continuity.

[0086] For example, from another perspective, the association between permission levels and instructions can be dynamically optimized in conjunction with employee roles. Assuming the employee's role is "junior staff," the system will further restrict the scope of instructions, limiting access only to highly sensitive data while maintaining access to their daily work data. This multi-dimensional adjustment approach effectively reduces interference with normal work while ensuring the security of core data.

[0087] For example, in real-world scenarios, the assessment of the scope of impact can be supplemented with data sensitivity analysis. Suppose the core data module being accessed involves a company's annual financial statements; the system will prioritize and increase the urgency of temporary lockout commands based on its high sensitivity attribute, ensuring that potential threats are quickly contained. This comprehensive approach can significantly improve the response efficiency of security protection.

[0088] The data gateway sends restriction commands to target users, adjusting access permission ranges in real time. During the adjustment process, the specific time and operation details of permission changes are recorded. The adjusted permission status is retrieved from the records to determine if it meets preset threshold requirements. Based on the permission status, the access logs in the data flow path are updated. The updated log content is categorized and stored. The categorized log data is retrieved, and it is determined whether the log data fully reflects the target user's access behavior, obtaining the latest flow path information. If the flow path information is inconsistent with preset path rules, the flow path is dynamically corrected through the data gateway. The corrected path data is retrieved, and it is determined whether the path data meets security status requirements, obtaining the corrected security status information.

[0089] For example, in the field of data security management, sending restriction commands to target users via a data gateway is a crucial step. Suppose an internal system detects that an employee is frequently accessing sensitive data areas outside of working hours. The system will send a restriction command in real time through the data gateway, changing the employee's access permissions from "full access" to "read-only." During the adjustment process, the system records the specific time of the permission change, such as 18:00 on October 10, 2023, and the operation content, such as "permission downgraded from full access to read-only," and stores these records in the permission change log. The adjusted permission status is extracted from the records to determine whether it meets preset threshold requirements, such as the permission level not being lower than "read-only" and not higher than "edit," to ensure security compliance.

[0090] Specifically, for updates to permission status, the system synchronously refreshes the access logs in the data flow path. Assuming the updated logs show that the employee can only view data but not modify it after the adjustment, the system will categorize and store the logs by time, user identity, and operation type. The categorized log data will be further examined to determine if it fully reflects the target user's access behavior, such as whether the time and results of all access attempts are recorded. If a missing access record is found in the logs, the system will trigger a supplementary entry mechanism to ensure the completeness of the flow path information.

[0091] In one embodiment, if the data flow path information is inconsistent with the preset path rules, such as an employee access path bypassing the core gateway node, the system will dynamically correct the path through the data gateway. Assuming the corrected path data mandates that all access must pass through the authentication node, the system will check whether the path meets security requirements, such as whether the authentication node's response time is within 5 seconds and the access failure rate is less than 1%. This correction ensures the security of data flow while improving the system's response efficiency.

[0092] For example, the categorized storage of access logs can be managed in a more detailed way from multiple perspectives. On the one hand, storing logs by time makes it easier to trace access behavior within a certain period; on the other hand, categorizing them by user identity facilitates the analysis of specific users' operating habits. These categorization methods support each other, forming a complete behavioral profile, which helps to quickly locate abnormal access. Such a design can also provide data support for subsequent security audits.

[0093] Specifically, when dynamically correcting the flow path, historical data analysis can be used to prioritize path nodes with higher security.

[0094] For example, the system selects the optimal path for data transfer based on the failure rate and response speed of each node over the past month. This approach not only ensures data security but also optimizes the user experience and reduces the inconvenience caused by access latency.

[0095] Key data is extracted from permission status and workflow records. Features are extracted from this key data, and pre-established classification rules are used to quantify changing indicators. By comparing historical data with current data, a preliminary set of changing indicators is obtained. This set of indicators is dynamically compared with preset security thresholds. If any indicator exceeds the threshold, it is marked as a potential risk, and a corresponding risk level label is generated to determine the range of indicators requiring further processing. The marked risk indicators are prioritized to determine the adjustment requirements for verification intensity. A logical decision tree tool is used to calculate the adjustment range, resulting in a specific verification intensity adjustment plan. Based on the adjusted verification intensity plan, and combined with risk level labels and key areas of focus, changes in relevant permission status and workflow records are continuously monitored. If new abnormal fluctuations are detected, a new round of dynamic comparison is triggered to determine the key areas for subsequent monitoring.

[0096] For example, when processing permission status and workflow records, key information can be extracted from the raw data first. Permission status typically reflects the range of resources a user can currently access, while workflow records document the movement of data within the system. Suppose that in an internal enterprise data management scenario, a user's permission status shows they can access core financial data, but workflow records show they have recently been frequently accessing data from unrelated modules. This abnormal behavior becomes key data. Through feature extraction, information such as access frequency, time period, and accessed modules can be transformed into quantifiable indicators. For example, an access frequency of 10 times per day, far exceeding the average of 2 times, initially indicates an anomaly.

[0097] For example, to quantify changing indicators, pre-established classification rules can be used to divide indicators such as access frequency and access duration into three levels: normal, high, and abnormal. Suppose that a user's historical average access frequency is 3 times per day, while the current data shows 15 times per day, a difference significantly exceeding the preset threshold of 5 times per day. In this case, the user is marked as a potential risk and a risk level label of "high risk" is generated. This approach helps to quickly locate problematic indicators and narrow down the scope requiring further processing.

[0098] For example, when prioritizing risk indicators, they can be categorized based on their scope of impact and urgency. Suppose two indicators are marked as high-risk: abnormal frequency of access to core data and excessively long access times to non-core modules. The former, involving sensitive data, is prioritized. This necessitates adjustments to verification strength, such as upgrading the verification method for core data access from a single password to multi-factor authentication. The adjustment magnitude, calculated using a logical decision tree tool, might involve adding a dynamic password verification step to ensure an improved security level.

[0099] For example, when continuously monitoring changes in permission status and workflow records, if new abnormal fluctuations are detected, such as a user suddenly accessing core data outside of working hours, a new round of dynamic comparison is triggered. The monitoring focus may shift to abnormal behavior within a specific time period, and relevant records are analyzed first, combined with risk level tags. This continuous monitoring mechanism can promptly identify potential problems and ensure the security of data access.

[0100] For example, in dynamic comparison and subsequent monitoring, the causes of abnormal fluctuations can be analyzed from multiple perspectives. If a user's access time is abnormal, it could be due to a change in personal habits or account theft. By comparing historical login locations and device information, if the login location changes from a frequently used city to an unfamiliar region, it is likely a sign of account security issues, requiring immediate strengthening of verification measures. This multi-faceted analysis helps to more comprehensively assess risks.

[0101] This application also discloses an access control system for enterprise data security, such as... Figure 2 As shown, it includes:

[0102] The first determining module 21 is used to determine the user's identity information and access information in response to the user's access request, wherein the access information includes the user's access time, access device, and access network;

[0103] The second determining module 22 is used to determine the user's initial permission range based on the preset correspondence between the identity information and permission information, wherein the permission range includes at least one of the permission information corresponding to the identity information;

[0104] The third determining module 23 is used to determine the degree of consistency between the access information and the preset access information;

[0105] The adjustment module 24 is used to adjust the initial permission range to the lowest permission range if the degree of conformity is lower than the degree threshold.

[0106] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0107] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0108] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0109] Based on the above, Figure 1The method illustrated in this application also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the method corresponding to any embodiment. The storage medium may further include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device and supports the operation of the information processing program and other software and / or programs. The network communication module is used to realize communication between the components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0110] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented using software plus necessary general-purpose hardware platforms, or it can be implemented using hardware. In response to a user's access request, the system determines the user's identity information and access information, including the user's access time, access device, and access network. Based on a preset correspondence between the identity information and permission information, the system determines the user's initial permission range, which includes at least one permission information corresponding to the identity information. It then determines the degree of consistency between the access information and the preset access information. If the degree of consistency is lower than a threshold, the initial permission range is adjusted to the minimum permission range. This application can obtain the user's identity information and access information after receiving a user's access request. If the user's access information does not match the preset access information, it can be considered that the user's access environment is insecure, and the user's access permissions can be restricted, thus better protecting enterprise data.

[0111] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0112] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An access control method for enterprise data security, characterized in that, include: In response to a user's access request, the system determines the user's identity information and access information, including the user's access time, access device, and access network. Based on the preset correspondence between the identity information and the permission information, the user's initial permission range is determined, and the permission range includes at least one of the permission information corresponding to the identity information; Determine the degree of consistency between the access information and the preset access information; If the degree of conformity is lower than the degree threshold, adjust the initial permission range to the lowest permission range; The access request includes: high-level permission information, which exceeds the initial permission range; After determining the degree of consistency between the access information and the preset access information, the method further includes: If the degree of conformity is greater than or equal to the degree threshold, the initial permission range is adjusted to a temporary permission range, the permission level of the temporary permission range is higher than the permission range of the initial permission range, and the temporary permission range includes the higher-level permission information; Wherein, adjusting the initial permission range to a temporary permission range if the degree of conformity is greater than or equal to the degree threshold includes: If the degree of similarity is greater than or equal to the degree threshold, determine the initial verification information corresponding to the identity information; Based on the initial verification information, actual verification information is determined, wherein the information security level of the actual verification information is higher than that of the initial verification information. Determine whether the user has passed the verification of the actual verification information; If the user passes the verification of the actual verification information, the initial permission range will be adjusted to a temporary permission range; Wherein, the minimum permission range or the temporary permission range is used as the final permission range, and after adjusting the initial permission range to the final permission range, the method further includes: Obtain the user's access data, which includes the access node, access time, and operation type. Based on the access data, determine the access risk value of the access data; If the access risk value is higher than the risk threshold, execute the permission restriction instruction; The step of determining the access risk value of the access data based on the access data includes: A path transparency analysis algorithm is used to determine access flow information by combining the access node and the access time; The access flow information is compared with preset legal flow information to determine whether the access data is legal; If the access data is invalid, the target node is identified as an illegal access node. Using a timely risk identification model, the access risk value when the accessed data accesses the target node is determined.

2. The method according to claim 1, characterized in that, If the degree of conformity is lower than the degree threshold, adjusting the initial permission range to the lowest permission range includes: If the degree of similarity is lower than the degree threshold, determine the initial verification information corresponding to the identity information; Based on the initial verification information, actual verification information is determined, wherein the information security level of the actual verification information is higher than that of the initial verification information. Determine whether the user has passed the verification of the actual verification information; If the user fails the verification of the actual verification information, the initial permission range is adjusted to the minimum permission range.

3. The method according to claim 1, characterized in that, The method of using a timely risk identification model to determine the access risk value when the accessed data accesses the target node includes: By using a risk identification model, the type of operation when the accessed data accesses the target node can be determined. Obtain the historical operation type, and determine the deviation value between the operation type and the historical operation type; Based on the deviation value, the access risk value when the access data accesses the target node is determined.

4. An access control system for enterprise data security, characterized in that, For performing the method as described in any one of claims 1-3, comprising: The first determining module is used to determine the user's identity information and access information in response to the user's access request, wherein the access information includes the user's access time, access device, and access network; The second determining module is used to determine the user's initial permission range based on the preset correspondence between the identity information and permission information, wherein the permission range includes at least one of the permission information corresponding to the identity information; The third determining module is used to determine the degree of consistency between the access information and the preset access information; An adjustment module is used to adjust the initial permission range to the lowest permission range if the degree of conformity is lower than the degree threshold.

5. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-3.

Images