A method for determining a security strategy

Abstract

This invention relates to the field of network security technology and discloses a method for determining a security policy. The method involves extracting all object resources, encrypting these resources, and setting access levels; collecting these object resources and establishing a security database, storing the resources within the database; extracting the feature names and access levels of the object resources to generate an access permission search form, where the feature names refer to the markers of the corresponding object resources; and sending an access request, which includes the feature names of the object resources to be viewed and their corresponding access levels, where the access level refers to the highest access level that allows viewing the object resources. If the access level is higher than or equal to the access level of the object resources to be viewed in the access request, then the object resources are extracted. Compared to traditional systems that require administrator approval to obtain corresponding access permissions, this invention is more efficient.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a method for determining a security strategy. Background Technology

[0002] AIdustry Security Platform is a SaaS-based security management as a service platform that connects security policies with AIdustry's security infrastructure, forming a coherent "people-process-technology" security management system to ensure the correct implementation of security policies. The core of the security platform is the security protection of data assets. It schedules security capabilities to provide a secure environment for data assets through the execution of security policies. The security platform's ability to provide security services to data assets is centered on security identifiers. The orchestration, scheduling, and execution of security policies are triggered by the setting of security identifiers. The security platform needs to provide rich interfaces to interface with the data platform, assign security identifiers to data assets, and use a security identifier policy calculation engine to schedule and orchestrate corresponding security policies based on the attributes of the security identifiers. The orchestrated security policies then drive various security capabilities (devices and software) through the policy execution engine to perform security protection.

[0003] Because systems typically store a large amount of reference or customer data, these resources are collectively referred to as object resources. These object resources may involve different levels and have varying economic or other values. During the daily operation of the system, these high-value object resources are often encrypted and cannot be accessed at will. Therefore, access requires requesting decryption permissions or keys from the administrator. However, during daily system operation, administrators need to handle a large number of requests, which often causes delays in approving requests to access encrypted object resources, thus affecting work efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide a method for determining a security strategy to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A method for determining a security policy, characterized in that the method includes:

[0007] Extract all object resources, encrypt the object resources and set access levels. The access levels are divided according to the value of the object resources. The higher the value of the object resources, the higher the corresponding access level.

[0008] The object resources are collected and a security database is established. The object resources are stored inside the security database. After extracting the feature name and access level of the object resources, an access permission retrieval form is generated. The feature name refers to the tag of the corresponding object resource. The object resources can be retrieved from the security database through the feature name, and the feature names of any two object resources are different.

[0009] Send an access request, which includes the feature name of the object resource to be viewed and the corresponding permission level. The permission level refers to the highest access level that can be accessed to view the object resource. If the permission level is higher than or equal to the access level of the object resource to be viewed in the access request, then the object resource is extracted.

[0010] As a further aspect of the present invention, the conventionally described object resources are in an encrypted state, and decryption is required to view them. The specific decryption steps are as follows:

[0011] Extract the feature name of the object resource and the key of the object resource, and generate a key retrieval list;

[0012] Accept access requests and extract their characteristic names and permission levels;

[0013] Extract the access level of the object resource under the feature name and compare it with the permission level in the access request;

[0014] If the permission level is greater than or equal to the access level of the object resource, then the key of the object resource is extracted from the key retrieval list.

[0015] Decrypting object resources using a key.

[0016] As a further aspect of the present invention, in order to ensure the confidentiality of the object resource, it will enter a self-destruct state after decryption. The self-destruct state refers to the object resource entering a countdown after decryption, and the object resource being destroyed when the countdown reaches zero.

[0017] As a further aspect of the present invention, in order to ensure that the object resource is not missing or damaged each time it is extracted from the security database, a copy is used instead of the original as the object to be extracted. The specific steps are as follows:

[0018] Access the security database and retrieve the object resources that need to be extracted from the security database by feature name;

[0019] Extract the object resource and the key of the object resource, and decrypt the object resource;

[0020] Extract the decrypted object resources and copy them;

[0021] The original object resource is encrypted again;

[0022] Extract a copy of the aforementioned object resource.

[0023] As a further aspect of the present invention, when the permission level in the access request is lower than the access level of the object resource specified by the feature name in the access request, the access request will be rejected and will not be granted.

[0024] As a further aspect of the present invention, after the same access request is rejected multiple times, a forced access phase will be initiated, which specifically includes the following steps:

[0025] Extract the feature name from the access request and obtain the access level of the object resource corresponding to that feature name;

[0026] Access requests are randomly sent to several mandatory access ports, where the permission level of the mandatory access ports is higher than or equal to the access level of the object resource.

[0027] The proportion of mandatory access ports that agree to the access request is calculated. If the proportion is greater than or equal to the set threshold, the access request is considered to have passed the mandatory access restriction.

[0028] Extract the access level of the object resource corresponding to the feature name in the access request, formulate an equal permission level based on the access level, and define the permission level as the mandatory permission level here. Replace the mandatory permission level with the permission level in the access request.

[0029] Send an updated access request.

[0030] As a further aspect of the present invention, if, during the forced access phase, the forced access port of the access request is less than a set threshold, the access request is determined to be an unreasonable access, and the sending of the access request is terminated.

[0031] As a further aspect of the present invention, the forced permission level enjoys all the functions of the same permission level, but its usage is limited and it becomes invalid after a single use. That is, after a single use, the forced permission level will lose all the functions of the same permission level.

[0032] As a further aspect of this invention, when the value of an object resource changes due to timeliness or other reasons, the access level of the object resource needs to be modified. The specific modification steps are as follows:

[0033] Extract the characteristic name and latest access level of the object resource;

[0034] Extract the access permission retrieval list and update the access level under the feature name corresponding to the object resource in the list.

[0035] Compared with the prior art, the beneficial effects of the present invention are: by quantifying and classifying all object resources, that is, a large amount of reference information or customer data collected within the system, and classifying each object resource into different levels, in the subsequent stage of accessing and browsing object data, a certain permission level can only access object resources equal to or first in that level. Compared with the traditional system where the corresponding access permissions are obtained through administrator approval, the present invention is more efficient. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention.

[0037] Figure 1 This is a flowchart illustrating a method for determining a security strategy applicable to an embodiment of the present invention.

[0038] Figure 2 This is a schematic diagram of a process for decrypting object resources provided in a preferred embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram of a process for extracting dense object resources provided in a preferred embodiment of the present invention.

[0040] Figure 4 This is a schematic diagram of a forced access process provided in a preferred embodiment of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] It should be noted that if there are directional indicators (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention, they are only used to explain the relative positional relationship and movement of the components in a certain specific posture. If the specific posture changes, the directional indicator will also change accordingly.

[0043] Furthermore, if the descriptions using terms such as "first" and "second" are used for descriptive purposes only, they should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed by this invention.

[0044] The specific implementation of the present invention will be described in detail below with reference to specific embodiments:

[0045] Because systems typically store a large amount of reference or customer data, these resources are collectively referred to as object resources. These object resources may involve different levels and have varying economic or other values. During the daily operation of the system, these high-value object resources are often encrypted and cannot be accessed at will. Therefore, access requires requesting decryption permissions or keys from the administrator. However, during daily system operation, administrators need to handle a large number of requests, which often causes delays in approving requests to access encrypted object resources, thus affecting work efficiency.

[0046] In this embodiment, all object resources are extracted, encrypted, and access levels are set. The object resources are collected and a secure database is established, storing the object resources within the secure database. A permission retrieval form is generated after extracting the characteristic names and access levels of the object resources. An access request is sent to retrieve the object resources. By quantifying and classifying all object resources—that is, the large amount of reference information or customer data collected within the system—each object resource is assigned a level. This ensures that during subsequent access to and browsing of object data, a specific permission level can only access object resources equal to or higher than that level. Compared to traditional systems where access permissions are obtained through administrator approval, this method is more efficient.

[0047] Example 1

[0048] Figure 1 The implementation flow of a security policy determination method according to the present invention is shown. This method is applied to devices capable of real-time internet connectivity, such as mobile phones, tablets, and computers, etc., without specific limitations. The detailed description of the security policy determination method is as follows:

[0049] Step S100: Extract all object resources, encrypt the object resources and set access levels. The access levels are divided according to the value of the object resources. The higher the value of the object resources, the higher the corresponding access level.

[0050] Step S200: Collect the object resources and establish a security database. The object resources are stored inside the security database. After extracting the feature name and access level of the object resources, a permission retrieval form is generated. The feature name refers to the marker of the corresponding object resource. The object resources can be retrieved from the security database through the feature name, and the feature names of any two object resources are different.

[0051] Step S300: Send an access request. The access request includes the feature name of the object resource to be viewed and the corresponding permission level. The permission level refers to the highest access level that can be used to view the object resource. If the permission level is higher than or equal to the access level of the object resource to be viewed in the access request, then the object resource is extracted.

[0052] Access control is a mechanism that restricts access to certain information items or controls based on a user's identity and membership in various predefined groups. Access control is typically used by system administrators to control user access to network resources (such as servers, directories, and files), and is usually implemented by granting users and groups permissions to access specific objects.

[0053] In addition, such as Figure 2 As shown, the object resources are typically encrypted and require decryption before they can be accessed. The specific decryption steps are as follows:

[0054] Step S101: Extract the feature name of the object resource and the key of the object resource, and generate a key retrieval list;

[0055] Step S102: Accept the access request and extract the feature name and permission level;

[0056] Step S103: Extract the access level of the object resource under the feature name and compare it with the permission level in the access request.

[0057] Step S104: If the permission level is greater than or equal to the access level of the object resource, then extract the key of the object resource from the key retrieval list.

[0058] Step S105: Decrypt the object resource using the key.

[0059] In this embodiment of the invention, it is understood that, in order to ensure the confidentiality of the object resource, it will enter a self-destruct state after decryption. The self-destruct state refers to the object resource entering a countdown after decryption, and the object resource being destroyed when the countdown reaches zero.

[0060] A secret key is a confidential piece of information used in cryptographic applications such as encryption, decryption, and integrity verification. In symmetric cryptography (or key-based cryptography), the same key is used for both encryption and decryption, so the key must be kept secret. In public-key cryptography (or asymmetric cryptography), different keys are used for encryption and decryption: one is usually public, called the public key; the other is kept secret, called the private key. Based on whether the encryption and decryption keys used in a cryptographic algorithm are the same, and whether the decryption process can be derived from the encryption process (or vice versa), cryptosystems can be divided into symmetric cryptosystems (also called single-key cryptosystems, secret-key cryptosystems, or symmetric-key cryptosystems) and asymmetric cryptosystems (also called two-key cryptosystems, public-key cryptosystems, or asymmetric-key cryptosystems). Symmetric-key encryption, also known as private-key encryption or session-key encryption algorithms, means that the sender and receiver of information use the same key to encrypt and decrypt data. Its biggest advantage is its fast encryption / decryption speed, making it suitable for encrypting large amounts of data. Therefore, in practical applications, people often use the two together. For example, symmetric key encryption systems are used to store large amounts of data, while public key encryption systems are used to encrypt keys.

[0061] Furthermore, in this embodiment of the invention, if the permission level in the access request is lower than the access level of the object resource specified by the feature name in the access request, the access request will be rejected and will not be granted.

[0062] and Figure 3 Another preferred embodiment of the present invention is shown, which illustrates the process of extracting object resources. Because a copy is used instead of the original as the object to be extracted each time an object resource is extracted from the security database to ensure that the object resource is not missing or damaged, the specific steps are as follows:

[0063] Step S201: Access the security database and retrieve the object resources to be extracted from the security database by feature name;

[0064] Step S202: Extract the object resource and the key of the object resource, and decrypt the object resource.

[0065] Step S203: Extract the decrypted object resources and copy them;

[0066] Step S204: Encrypt the original object resource again;

[0067] Step S205: Extract the copy of the object resource.

[0068] like Figure 4 As shown, another preferred embodiment of the present invention is provided, in which after the same access request is rejected multiple times, a forced access phase will be entered, and the forced access specifically includes the following steps:

[0069] Step S301: Extract the feature name from the access request and obtain the access level of the object resource corresponding to the feature name;

[0070] Step S302: Randomly issue access requests to several mandatory access ports, wherein the permission level of the mandatory access port is higher than or equal to the access level of the object resource.

[0071] Step S303: Calculate the proportion of mandatory access ports that agree to the access request. If the proportion is greater than or equal to the set threshold, the access request is considered to have passed the mandatory access restriction.

[0072] Step S304: Extract the access level of the object resource corresponding to the feature name in the access request, formulate an equal permission level according to the access level, the permission level is defined here as the mandatory permission level, and replace the mandatory permission level with the permission level in the access request.

[0073] Step S305: Send the updated access request.

[0074] It is understood that in this embodiment, if the forced access port of the access request is less than the set threshold during the forced access phase, the access request is determined to be an unreasonable access, and the sending of the access request is terminated.

[0075] It is worth noting that the forced permission level cannot permanently replace the original permission level. Although the forced permission level enjoys all the functions of the same permission level, its usage is limited and it becomes invalid after a single use. That is, after a single use, the forced permission level will lose all the functions of the original permission level.

[0076] In another preferred embodiment of the present invention, when the value of an object resource changes due to timeliness or other reasons, the access level of the object resource needs to be modified. The specific modification steps are as follows:

[0077] Extract the characteristic name and latest access level of the object resource;

[0078] Extract the access permission retrieval list and update the access level under the feature name corresponding to the object resource in the list.

[0079] The functions achievable by the method for determining a security strategy are all performed by a computer device, which includes one or more processors and one or more memories. The one or more memories store at least one piece of program code, which is loaded and executed by the one or more processors to implement the functions of the power grid engineering design unit management method.

[0080] The processor fetches instructions from memory one by one, analyzes the instructions, and then performs the corresponding operations according to the instructions, generating a series of control commands to enable the various parts of the computer to act automatically, continuously, and in a coordinated manner, forming an organic whole. This enables the input of programs and data, as well as the calculation and output of results. The arithmetic or logical operations generated in this process are all performed by the arithmetic unit. The memory includes a read-only memory (ROM), which is used to store computer programs. The memory is equipped with external protection devices.

[0081] For example, a computer program can be divided into one or more modules, one or more of which are stored in memory and executed by a processor to perform the present invention. The one or more modules can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a terminal device.

[0082] Those skilled in the art will understand that the above description of the service equipment is merely an example and does not constitute a limitation on the terminal equipment. It may include more or fewer components than described above, or a combination of certain components, or different components, such as input / output devices, network access devices, buses, etc.

[0083] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the terminal device, connecting various parts of the user terminal via various interfaces and lines.

[0084] The aforementioned memory can be used to store computer programs and / or modules. The aforementioned processor implements various functions of the aforementioned terminal device by running or executing the computer programs and / or modules stored in the memory, and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as information collection template display function, product information publishing function, etc.); the data storage area may store data created based on the use of the berth status display system (such as product information collection templates corresponding to different product types, product information that different product providers need to publish, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0085] If the modules / units integrated into the terminal device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the modules / units in the systems of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the functions of the various system embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0086] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0087] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for determining a security strategy, characterized in that, The method includes: Extract all object resources, encrypt the object resources and set access levels. The access levels are divided according to the value of the object resources. The higher the value of the object resources, the higher the corresponding access level. The object resources are collected and a security database is established. The object resources are stored inside the security database. After extracting the feature name and access level of the object resources, an access permission retrieval form is generated. The feature name refers to the tag of the corresponding object resource. The object resources can be retrieved from the security database through the feature name, and the feature names of any two object resources are different. Send an access request, which includes the feature name of the object resource to be viewed and the corresponding permission level. The permission level refers to the highest access level that can be accessed to view the object resource. If the permission level is higher than or equal to the access level of the object resource to be viewed in the access request, then the object resource is extracted. To ensure the confidentiality of the object resources, they will enter a self-destruct state after decryption. The self-destruct state means that the object resources will enter a countdown after decryption, and the object resources will be destroyed when the countdown reaches zero. After the same access request is rejected multiple times, the forced access phase will begin, which specifically includes the following steps: Extract the feature name from the access request and obtain the access level of the object resource corresponding to that feature name; Access requests are randomly sent to several mandatory access ports, where the permission level of the mandatory access ports is higher than or equal to the access level of the object resource. The proportion of mandatory access ports that agree to the access request is calculated. If the proportion is greater than or equal to the set threshold, the access request is considered to have passed the mandatory access restriction. Extract the access level of the object resource corresponding to the feature name in the access request, formulate an equal permission level based on the access level, and define the permission level as the mandatory permission level here. Replace the mandatory permission level with the permission level in the access request. Send an updated access request.

2. The method for determining a security strategy according to claim 1, characterized in that, The object resources mentioned above are usually encrypted and require decryption before they can be viewed. The specific decryption steps are as follows: Extract the feature name of the object resource and the key of the object resource, and generate a key retrieval list; Accept access requests and extract their characteristic names and permission levels; Extract the access level of the object resource under the feature name and compare it with the permission level in the access request; If the permission level is greater than or equal to the access level of the object resource, then the key of the object resource is extracted from the key retrieval list. Decrypting object resources using a key.

3. The method for determining a security strategy according to any one of claims 1-2, characterized in that, To prevent missing or corrupted object resources when retrieving them from the security database, a copy must be used instead of the original. The specific steps are as follows: Access the security database and retrieve the object resources that need to be extracted from the security database by feature name; Extract the object resource and the key of the object resource, and decrypt the object resource; Extract the decrypted object resources and copy them; The original object resource is encrypted again; Extract a copy of the aforementioned object resource.

4. The method for determining a security strategy according to claim 1, characterized in that, If the permission level in the access request is lower than the access level of the object resource specified by the feature name in the access request, the access request will be rejected and will not be granted.

5. The method for determining a security strategy according to claim 1, characterized in that, If, during the forced access phase, the forced access port for the access request is less than the set threshold, the access request is determined to be an unreasonable access, and the sending of the access request is terminated.

6. The method for determining a security strategy according to claim 1, characterized in that, The mandatory permission level enjoys all the functions of the same permission level, but its usage is limited and it becomes invalid after a single use. That is, after a single use, the mandatory permission level will lose all the functions of the same permission level.

7. The method for determining a security strategy according to claim 1, characterized in that, When the value of an object resource changes due to timeliness, the access level of the object resource needs to be modified. The specific modification steps are as follows: Extract the characteristic name and latest access level of the object resource; Extract the access permission retrieval list and update the access level under the feature name corresponding to the object resource in the list.

Images