Dynamic authority and data boundary control system and method based on behavior credit

Abstract

The invention discloses a dynamic authority and data boundary control system and method based on behavior credit, and belongs to the technical field of computer security and access control. The method comprises the steps of collecting behavior data of a user in real time and constructing a time sequence feature vector, wherein the behavior data comprises user native data and system interaction data; dynamically calculating a behavior credit score of the user based on a time sequence model; mapping the behavior credit score to a fine-grained dynamic permission level through a nonlinear mapping function; and performing real-time authentication and control on data access, function calling and resource operation requests of the user according to the dynamic permission level. By establishing a dynamic credit evaluation and authority adaptive adjustment mechanism driven by behavior data, the technical problem that a traditional authority system is static and rigid and is difficult to adapt to the real-time trust state change of a user is solved, and the security and adaptive capability of a digital system are improved.

Description

Technical Field

[0001] This invention relates to the fields of computer security, access control and system governance, and in particular to a system and method for real-time analysis of user behavior time-series characteristics, dynamic credit assessment and adaptive permission adjustment. Background Technology

[0002] Existing access control systems have fundamental flaws and cannot meet the needs of the next-generation digital ecosystem for dynamic, precise, and adaptive security governance: The static and rigid nature of permission allocation: Role-based access control and other models cannot adapt to the dynamic changes in user behavior and trust levels. Once permissions are granted, it is difficult to automatically adjust them based on the user's real-time risk performance, resulting in the long-term coexistence of "excessive permissions" and "insufficient permissions".

[0003] Weak foundation of credit assessment data: Some systems that attempt dynamic adjustment rely on single-dimensional and unsystematic behavioral data for credit assessment. They are often limited to a few types of system interaction data (such as login logs) and fail to comprehensively consider a wider range of native user behavior data, environmental data and their derived status indicators (such as spatiotemporal relative phase values ​​and structured situational labels from upstream perception and cognition systems). This results in a one-sided credit profile that cannot truly reflect the user's overall trust level.

[0004] Security and user experience are at odds: strict access controls implemented to ensure security often compromise user experience and system flexibility; while open permissions bring risks of internal abuse and data breaches. Current technologies lack a fine-grained adaptive control mechanism that can smoothly adjust permission levels based on real-time creditworthiness, thus failing to achieve a balance between security and user experience.

[0005] Lagging response and governance: The detection and response to internal threats or abuse of privileges rely heavily on manual intervention or simple rule-based alerts, which cannot achieve millisecond-level automatic risk identification, privilege circuit breaking and dynamic contraction, resulting in a serious lack of system security resilience.

[0006] Therefore, there is an urgent need in this field for a security governance infrastructure that can dynamically assess user credit based on multi-dimensional and systematic behavioral data, and automatically and quickly adjust their data access and function operation permissions accordingly. Summary of the Invention

[0007] (a) Purpose of the invention The purpose of this invention is to overcome the shortcomings of the prior art and provide a dynamic permission and data boundary control system and method based on behavioral credit, so as to realize the synchronous adjustment of permissions and real-time user credit based on multi-dimensional behavioral data evaluation, thereby improving the security and adaptability of the system.

[0008] (II) Technical Solution To achieve the above-mentioned objectives, the present invention adopts the following technical solution: a dynamic permission and data boundary control method based on behavioral credit, the core of which lies in constructing a real-time mapping and control closed loop of "behavior-credit-permission"; the method includes: Real-time collection of user behavior data, and construction of temporal feature vectors representing behavior patterns; Based on the time-series feature vector, the user's behavioral credit score is dynamically calculated through a credit assessment model. Based on predefined mapping rules, the behavioral credit score is mapped to the corresponding system dynamic permission level; When a user initiates an operation request, real-time authentication and access control are performed based on the user's current dynamic permission level. In addition, the system records permission usage behavior and authentication results, and inputs them as feedback data into the credit assessment model to form a closed-loop optimization.

[0009] A dynamic access control and data boundary control system based on behavioral credit, used to implement the above method, the system comprising: The behavior data acquisition module is used to collect user behavior data (i.e., user native data and system interaction data) in real time and construct a time-series feature vector representing behavior patterns. The dynamic credit assessment module is used to dynamically calculate the user's behavioral credit score based on the time-series feature vector and through the credit assessment model. The permission mapping module is used to map the behavior credit score to the corresponding dynamic system permission level based on predefined mapping rules; The real-time authentication and control module is used to perform real-time authentication and access control based on the user's current dynamic permission level when the user initiates an operation request.

[0010] (III) Beneficial Effects Compared with the prior art, the present invention has the following beneficial effects: It achieves dynamic and adaptive adjustment of permissions, allowing permissions to change in real time according to user behavior and credit, thus solving the technical problem of static and rigid traditional permission systems.

[0011] An endogenous credit mechanism based on behavioral data was constructed, establishing a governance logic of "behavior determines credit, and credit determines authority".

[0012] Through a rapid permission-based circuit breaker mechanism and closed-loop feedback, the system possesses self-healing capabilities to cope with internal abuse and external attacks, thereby enhancing the system's security resilience. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the system module composition provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the method flow provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the nonlinear mapping relationship between credit score and dynamic permission level in an embodiment of the present invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. The following embodiments are for illustrative purposes only and should not be considered as limiting the scope of the invention.

[0015] Figure 1 The system consists of four core modules, clearly demonstrating the complete governance loop from behavioral data collection to real-time access control.

[0016] Figure 2 The paper demonstrates the five core steps of the dynamic access control method, corresponding to S501 to S505 in claims 1 and 6, and emphasizes closed-loop optimization.

[0017] Figure 3 middle, X-axis: Behavioral credit score (from low to high) Y-axis: System privilege level (from low to high) Curve characteristics: Low credit zone (score < first threshold): permission level is extremely suppressed, the curve is flat, and access is strictly limited; Medium credit zone (first threshold ≤ score < second threshold): the access level increases significantly with the credit score, the curve slope is the steepest, and the access range expands rapidly and smoothly; High credit zone (score ≥ second threshold): The permission level is close to saturation, the curve flattens again, and it enters the "trust but verification" zone with slow growth but enhanced auditing.

[0018] Example 1

[0019] See Figure 2 The dynamic permission and data boundary control method provided in this embodiment includes the following steps:

[0020] Step S501: Behavioral data collection and characterization.

[0021] The behavior data acquisition module continuously collects multidimensional behavior data of users (including user native data and system interaction data). After cleaning and standardization, the data is constructed into a time-series feature vector to represent the user's behavior pattern.

[0022] Step S502: Dynamic credit assessment.

[0023] The dynamic credit assessment module receives the time-series feature vector, processes it through a pre-trained behavioral credit assessment model, and outputs the user's behavioral credit score and optional multi-dimensional assessment sub-scores.

[0024] Step S503: Non-linear permission mapping.

[0025] The permission mapping module determines the user's current dynamic permission level based on the behavioral credit score using a piecewise nonlinear function. (See also...) Figure 3 This mapping relationship is typically characterized by: sharp convergence of permissions in low-credit partitions, smooth expansion in medium-credit partitions, and near-full access to permissions in high-credit partitions, but accompanied by stricter behavior auditing.

[0026] Step S504: Real-time authentication and control.

[0027] When a user initiates an operation request, the real-time authentication and control module intercepts the request, performs millisecond-level authentication based on the user's current dynamic permission level, and decides whether to allow or deny the request.

[0028] Step S505: Closed-loop feedback and optimization.

[0029] The system records permission usage behavior and authentication results, and uses this as feedback data to continuously optimize the behavior credit assessment model, forming a self-improving governance loop.

[0030] Example 2 To verify the effectiveness of this system, system performance testing was conducted.

[0031] Experimental setup: Simulate scenarios of internal personnel abusing their privileges and external malicious crawling attacks, and measure the average response time of the core monitoring system from detecting an anomaly to automatically triggering the permission circuit breaker.

[0032] Experimental results: In 1000 simulated attacks, the accuracy rate of this system in detecting privilege abuse was 98.7%, with an average circuit breaker response time of less than 100 milliseconds. In contrast, the detection accuracy rate of traditional static permission systems is 72.1%, and they rely on manual intervention with response times ranging from several hours to several days.

[0033] Experimental conclusion: Experimental data shows that this system can quickly identify and automatically respond to permission abuse, significantly improving the system's proactive defense capabilities and security resilience.

[0034] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic permission and data boundary control method based on behavioral credit, characterized in that, include: Step S501: Collect user behavior data in real time and construct a time-series feature vector representing user behavior patterns; Step S502: Based on the time-series feature vector, dynamically calculate the user's behavioral credit score through a credit assessment model; Step S503: Based on predefined mapping rules, map the behavior credit score to the corresponding system permission level; Step S504: When a user initiates an operation request, perform real-time authentication and access control based on the user's current system permission level.

2. The method according to claim 1, characterized in that, In step S501, the behavioral data includes user native data and system interaction data.

3. The method according to claim 1, characterized in that, In step S502, the credit assessment model is a machine learning-based behavioral analysis model, whose output includes behavioral credit scores and assessment sub-scores for multiple credit dimensions.

4. The method according to claim 1, characterized in that, In step S503, the mapping rule is a non-linear function configured such that when the credit score is below the first threshold, the dynamic permission level converges sharply; when the credit score is between the first threshold and the second threshold, the dynamic permission level expands smoothly; and when the credit score is above the second threshold, the dynamic permission level is close to fully open and accompanied by enhanced audit supervision.

5. The method according to claim 1, characterized in that, In step S504, the dynamic permission level control grants access permissions to at least one of the following: data access scope, application programming interface call frequency, computing resource quota, and token operation quota.

6. The method according to claim 1, characterized in that, The method further includes: Step S505: Record the user's permission usage behavior and authentication results, and input them as feedback data into the credit assessment model to form a closed-loop optimization.

7. A dynamic permission and data boundary control system based on behavioral credit, used to implement the method as described in any one of claims 1 to 6, characterized in that, include: A behavior data acquisition module is used to perform step S501; A dynamic credit assessment module is used to perform step S502; The permission mapping module is used to execute step S503; The real-time authentication and control module is used to execute step S504.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images