Method and device for data access control

Abstract

The present invention provides a method and device for data access control, which includes: when receiving an access request for sensitive data sent by a user terminal, obtaining access attributes of the access request and sensitive attributes of the sensitive data; determining the user intention for the user identifier; determining behavioral habit information for the user identifier; determining a first security level for the user identifier based on the user intention, access time and behavioral habit information, obtaining log information of the sensitive data, and determining a second security level for the sensitive data based on the log information; based on the first security level and the second security level, using a preset verification strategy to verify the user identifier, and if the verification passes, allowing the user identifier to access the sensitive data, thereby realizing data access control after the account is logged in, protecting the security of sensitive data, and preventing criminals from stealing sensitive data after logging in to the account.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for data access control. Background Art

[0002] With computers being the primary means of conducting business, data security has become a key concern for businesses. Once a user account is compromised, it can cause immeasurable losses to the account holder. For example, in an online bidding event, if a competitor were to use their account to obtain their bid, they could potentially lose their competitive advantage.

[0003] Currently, the common practice to ensure data security is to verify the password when logging into an account, but there is a lack of preventive measures after the account is logged in. It is impossible to identify the legitimacy of the access request from the logged-in user. Once the account password is leaked, criminals can easily obtain data assets after logging in, causing immeasurable losses. Summary of the Invention

[0004] In view of the above problems, a method and apparatus for data access control are proposed to overcome the above problems or at least partially solve the above problems, including:

[0005] A method for data access control, comprising:

[0006] Upon receiving an access request for sensitive data sent by a user terminal, obtaining access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification;

[0007] Determining permission information of the user identifier for the sensitive data, and determining user intent for the user identifier using the permission information, the access time, and the sensitive attribute;

[0008] Obtaining historical operation data of the user identifier from a preset database, and determining behavioral habit information for the user identifier based on the historical operation data;

[0009] Determining a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtaining log information of the sensitive data, and determining a second security level for the sensitive data based on the log information;

[0010] According to the first security level and the second security level, a preset verification strategy is used to verify the user identification, and if the verification passes, the user identification is allowed to access the sensitive data.

[0011] Optionally, the sensitive attribute includes a sensitive period for the sensitive data, and the step of determining the user intention for the user identifier using the permission information, the access time, and the sensitive attribute includes:

[0012] Determining, based on the permission information, a plurality of candidate operation items for the user identifier from a plurality of preset operation items;

[0013] determining, according to preset operation item distribution regularity data, candidate operation item distribution information of the plurality of candidate operation items within the sensitive period, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data;

[0014] A target operation item is determined from the plurality of candidate operation items according to the access time and the candidate operation item distribution information, and a user intention for the user identifier is determined according to the target operation item, wherein the user intention corresponds to the target operation item.

[0015] Optionally, the step of determining the behavioral habit information for the user identifier based on the historical operation data includes:

[0016] Based on the historical operation data, collecting time habit information and frequency habit information of the user identifier for each candidate operation item;

[0017] Behavior habit information for the user identifier is obtained according to the time habit information and frequency habit information of each candidate operation item.

[0018] Optionally, the step of determining the second security level of the sensitive data according to the log information includes:

[0019] Determining the number of illegal accesses to the sensitive data from the log information;

[0020] Divide the log duration corresponding to the log information into a plurality of preset periods according to a preset time interval, and count the number of illegal accesses in each preset period;

[0021] A second security level of the sensitive data is determined according to the number of illegal accesses in each preset period.

[0022] Optionally, the step of verifying the user identifier using a preset verification strategy according to the first security level and the second security level includes:

[0023] When both the first security level and the second security level trigger a specified security event, sending a face verification request to the user terminal corresponding to the user identifier;

[0024] Receive a real-time face image returned by the user terminal in response to the face verification request, and perform feature matching between the real-time face image and a preset verification face image.

[0025] Optionally, the step of verifying the user identifier using a preset verification strategy according to the first security level and the second security level includes:

[0026] generating a permission query for the access request based on the access attribute when one of the first security level and the second security level triggers a specified security event;

[0027] Obtaining a communication terminal identifier bound to the user identifier from a preset address book, and sending the permission query to the communication terminal corresponding to the communication terminal identifier;

[0028] A response to the permission inquiry returned by the communication terminal is received.

[0029] A data access control device, comprising:

[0030] an attribute module, configured to, upon receiving an access request for sensitive data sent by a user terminal, obtain access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification;

[0031] A user intention module, configured to determine permission information of the user identifier for the sensitive data, and determine the user intention for the user identifier using the permission information, the access time, and the sensitive attribute;

[0032] A behavior habit module, configured to obtain historical operation data of the user identifier from a preset database, and determine behavior habit information for the user identifier based on the historical operation data;

[0033] a security level module, configured to determine a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtain log information of the sensitive data, and determine a second security level for the sensitive data based on the log information;

[0034] The verification module is used to verify the user identification using a preset verification strategy according to the first security level and the second security level, and allow the user identification to access the sensitive data if the verification passes.

[0035] Optionally, the user intention module includes:

[0036] A candidate operation item submodule, configured to determine, based on the permission information, a plurality of candidate operation items for the user identifier from a plurality of preset operation items;

[0037] a candidate operation item distribution information submodule, configured to determine candidate operation item distribution information of the plurality of candidate operation items within the sensitive period based on preset operation item distribution regularity data, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data;

[0038] A user intention submodule is configured to determine a target operation item from the multiple candidate operation items based on the access time and the candidate operation item distribution information, and determine a user intention for the user identifier based on the target operation item, wherein the user intention corresponds to the target operation item.

[0039] An electronic device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the data access control method described above when executed by the processor.

[0040] A computer-readable storage medium stores a computer program, which implements the data access control method described above when executed by a processor.

[0041] The embodiments of the present invention have the following advantages:

[0042] In an embodiment of the present invention, upon receiving an access request for sensitive data sent by a user terminal, the access attributes of the access request and the sensitive attributes of the sensitive data are obtained, wherein the access attributes include access time and user ID; the permission information of the user ID for the sensitive data is determined, and the user intention for the user ID is determined using the permission information, the access time and the sensitive attributes; the historical operation data of the user ID is obtained from a preset database, and the behavioral habit information for the user ID is determined based on the historical operation data; a first security level for the user ID is determined based on the user intention, the access time and the behavioral habit information; log information of the sensitive data is obtained, and a second security level for the sensitive data is determined based on the log information; based on the first security level and the second security level, the user ID is verified using a preset verification strategy, and if the verification passes, the user ID is allowed to access the sensitive data. This achieves data access control after account login, protects the security of sensitive data, and prevents criminals from stealing sensitive data after logging into the account. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the description of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 This is a flowchart of a method for data access control provided by one embodiment of the present invention;

[0045] Figure 2 is a flowchart of another method for data access control provided by one embodiment of the present invention;

[0046] Figure 3 This is a structural block diagram of a data access control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are also within the scope of protection of the present invention.

[0048] Reference Figure 1 , shows a flowchart of a method for data access control provided by an embodiment of the present invention, which may specifically include the following steps:

[0049] Step 101: upon receiving an access request for sensitive data from a user terminal, obtaining access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification;

[0050] Wherein, sensitive data can be data that is relatively important to the user.In practical application, a storage area can be set, and the user can store sensitive data therein.

[0051] As an example, sensitive data may be quotation data provided by a user for a bidding project in an online bidding activity.

[0052] The sensitive attribute of the sensitive data may be the sensitive timeliness of the sensitive data, that is, the sensitive period.

[0053] For example, in a public bidding activity, sensitive data may be quotation data, which needs to be published at a set time. Another example is an online exam, where sensitive data may be test questions, which need to be opened at the set start time.

[0054] After a user successfully logs in, to ensure the security of sensitive data, upon receiving an access request for sensitive data from a user terminal, the access attributes of the access request and the sensitive attributes of the sensitive data can be obtained. The access attributes include the access time and the user ID. The user ID corresponds to the logged-in user account.

[0055] The user terminal may be configured to carry the user identifier when sending an access request, and then the user identifier may be obtained from the access request when the access request is received.

[0056] The access time can be determined based on the server's local system time.

[0057] Step 102: determining permission information of the user identifier for the sensitive data, and determining the user intention for the user identifier using the permission information, the access time, and the sensitive attribute;

[0058] The user's intent may correspond to the user's permissions for sensitive data. As an example, the user's intent may include viewing, deleting, modifying, etc., of the sensitive data.

[0059] To ensure the security of sensitive data, it's possible to determine whether the logged-in user account is actually the user. This can be done by determining the user ID's permissions for sensitive data from a pre-set permissions table. This permission information, access time, and sensitive attributes can then be used to predict the user ID's user intent. This user intent represents the intent of the user account currently operating the user ID.

[0060] Step 103: acquiring historical operation data of the user identifier from a preset database, and determining behavioral habit information for the user identifier based on the historical operation data;

[0061] In order to determine whether the user currently operating the user ID is the real person, after determining the user intention, the behavioral habits of the owner corresponding to the user ID can be further analyzed.

[0062] In a specific implementation, historical operation data for a user ID can be obtained from a pre-set database, and behavioral habit information specific to the user ID can be determined based on the historical operation data. The historical operation data can include operation data on sensitive data associated with the user ID. The pre-set database can be used to store user operation data, such as operation data generated by operations such as deleting, viewing, and modifying data.

[0063] Step 104: determining a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtaining log information of the sensitive data, and determining a second security level for the sensitive data based on the log information;

[0064] After obtaining the user intention and the behavioral habit information of the user identifier, the first security level for the user identifier can be determined in combination with the access time. The first security level can represent the risk level of the user account corresponding to the user identifier being stolen.

[0065] In order to avoid verification troubles caused by misjudgment and improve user experience, log information of sensitive data can be obtained, and then the second security level of the sensitive data can be determined based on the log information, so as to perform security verification on the user identity in combination with the security level of the sensitive data.

[0066] Step 105: Verify the user identification using a preset verification strategy based on the first security level and the second security level, and if the verification is successful, allow the user identification to access the sensitive data.

[0067] In a specific implementation, a preset verification strategy may be used to verify the user ID based on the first security level and the second security level, such as a facial image recognition strategy. If the verification passes, the user ID may be allowed to access sensitive data.

[0068] In an embodiment of the present invention, upon receiving an access request for sensitive data sent by a user terminal, access attributes of the access request and sensitive attributes of the sensitive data are obtained, wherein the access attributes include an access time and a user identifier; permission information of the user identifier for the sensitive data is determined, and the user intention for the user identifier is determined using the permission information, the access time, and the sensitive attributes; historical operation data of the user identifier is obtained from a preset database, and behavioral habit information for the user identifier is determined based on the historical operation data; a first security level for the user identifier is determined based on the user intention, the access time, and the behavioral habit information, and log information of the sensitive data is obtained, and a second security level for the sensitive data is determined based on the log information; based on the first security level and the second security level, the user identifier is verified using a preset verification strategy, and if the verification passes, the user identifier is allowed to access the sensitive data. This achieves the goal of analyzing the user intention, the access time, and the behavioral habit of the user terminal that issues the access request, verifying the security level of the access request, and determining whether to allow access, thereby achieving data access control after account login, protecting the security of sensitive data, and preventing criminals from stealing sensitive data after logging into the account.

[0069] Reference Figure 2 , shows a flowchart of another data access control method provided by an embodiment of the present invention, which may specifically include the following steps:

[0070] Step 201: upon receiving an access request for sensitive data from a user terminal, obtaining access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification;

[0071] Step 202: Determine the permission information of the user identifier for the sensitive data, and determine the user intention for the user identifier using the permission information, the access time, and the sensitive attribute;

[0072] In one embodiment of the present invention, the sensitive attribute includes a sensitive period for the sensitive data, and step 202 may include the following sub-steps:

[0073] Sub-step S11, determining multiple candidate operation items for the user identifier from multiple preset operation items based on the permission information;

[0074] The sensitive period of sensitive data refers to the time limit for sensitive data to be deleted upon reaching the specified sensitive period. For example, the sensitivity of quote data is deleted upon the set date of publication. The sensitivity of online exam questions is deleted upon the start of the exam.

[0075] The sensitive data in the embodiment of the present invention is data with sensitive timeliness.

[0076] The permission information may include multiple operation permissions, and the operation permissions may correspond to preset operation items, such as deletion permission, viewing permission, and modification permission.

[0077] In a specific implementation, multiple candidate operation items for the user identifier, such as delete, view, and modify, can be determined from multiple preset operation items based on the permission information of the user identifier for sensitive data.

[0078] Sub-step S12: determining, based on preset operation item distribution regularity data, candidate operation item distribution information of the plurality of candidate operation items within the sensitive period, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data;

[0079] The preset operation item distribution pattern data includes distribution patterns of multiple operation items, which can represent the distribution patterns of operations performed by users on sensitive data during a sensitive period after the sensitive data is created.

[0080] For example, after a user creates a test question, the user's modifications to the test question will be concentrated in the middle time period of the sensitive period, while in the time period close to the test start, the user will not modify the test question.

[0081] The distribution regularity data of operation items for sensitive data can be calculated in advance based on historical sensitive data that is similar or identical to the sensitive data.

[0082] Then, preset operation item distribution regularity data may be obtained to determine candidate operation item distribution information of the multiple candidate operation items within the sensitive period.

[0083] Sub-step S13, determining a target operation item from the multiple candidate operation items according to the access time and the candidate operation item distribution information, and determining a user intention for the user identifier according to the target operation item, wherein the user intention corresponds to the target operation item.

[0084] After obtaining the distribution pattern data of operation items for sensitive data, the target operation item that needs to be executed by the logged-in user ID can be predicted from multiple candidate operation items based on the access time, and then the user intention for the user ID can be determined based on the target operation item. For example, the target operation item can be used as the user intention for the user ID.

[0085] Step 203: Obtain historical operation data of the user identifier from a preset database, and determine behavioral habit information for the user identifier based on the historical operation data;

[0086] In one embodiment of the present invention, step 203 may include the following sub-steps:

[0087] Sub-step S21, based on the historical operation data, statistics the time habit information and frequency habit information of the user identifier for each candidate operation item;

[0088] Sub-step S22, obtaining behavior habit information for the user identifier based on the time habit information and frequency habit information of each candidate operation item.

[0089] Patterns in user operation behavior can serve as user identification features. For example, if a user prefers to handle business at night, the corresponding operation items in their operation data will be concentrated during nighttime hours. If a user usually handles business during the day, their operation data will mainly be generated during working hours. Another example is that after creating sensitive data, users rarely delete, view, or modify it.

[0090] In a specific implementation, the user identifier's time habit information and frequency habit information for each candidate operation item can be counted based on the user identifier's historical operation data, and then the behavioral habit information for the user identifier can be obtained based on the time habit information and frequency habit information of each candidate operation item.

[0091] Step 204: determining a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information;

[0092] Step 205: Obtain log information of the sensitive data, and determine the number of illegal accesses to the sensitive data from the log information;

[0093] Among them, illegal access represents access requests that are blocked for access to sensitive data. The number of illegal accesses can represent the risk level of sensitive data being invaded. The higher the number, the higher the possibility of sensitive data being invaded.

[0094] In a specific implementation, log information of sensitive data can be obtained, and the number of illegal accesses to the sensitive data can be counted based on the log information.

[0095] Step 206: Divide the log duration corresponding to the log information into a plurality of preset periods according to a preset time interval, and count the number of illegal accesses in each preset period;

[0096] In order to accurately obtain the security level of sensitive data at the current time, the log duration corresponding to the log information can be divided into multiple preset periods according to preset time intervals, and the number of illegal accesses in each preset period can be counted separately.

[0097] Step 207: determining a second security level of the sensitive data based on the number of illegal accesses in each preset period;

[0098] After obtaining the number of illegal accesses in each preset period by counting the log information, the number of illegal accesses in multiple preset periods can be obtained. The second security level for sensitive data can be determined based on the changing trend of the number of illegal accesses in multiple preset periods.

[0099] Step 208: Based on the first security level and the second security level, a preset verification strategy is used to verify the user identification, and if the verification passes, the user identification is allowed to access the sensitive data.

[0100] In one embodiment of the present invention, step 208 may include the following sub-steps:

[0101] Sub-step S31: sending a face verification request to the user terminal corresponding to the user identifier when both the first security level and the second security level trigger a specified security event;

[0102] Sub-step S32: receiving a real-time face image returned by the user terminal in response to the face verification request, and performing feature matching between the real-time face image and a preset verification face image.

[0103] Among them, designated security events can indicate the risk of theft of sensitive data.

[0104] In actual applications, a preset security level for triggering a security event may be set, and when the first security level or the second security level is lower than the preset security level, a designated security event is triggered.

[0105] When a specified security event is triggered at both the first security level and the second security level, indicating a high risk of sensitive data theft, a face verification request can be sent to the user terminal corresponding to the user corresponding to the user identifier to obtain the face image data of the user currently logged in with the user identifier, and perform image feature matching with the preset verification face image for face image verification, and determine whether the verification is passed based on the matching result.

[0106] In one embodiment of the present invention, step 208 may include the following sub-steps:

[0107] Sub-step S41, when one of the first security level and the second security level triggers a designated security event, generating a permission query for the access request based on the access attribute;

[0108] Sub-step S42, obtaining the communication terminal identifier bound to the user identifier from a preset address book, and sending the permission query to the communication terminal corresponding to the communication terminal identifier;

[0109] Sub-step S43: receiving a response to the permission inquiry returned by the communication terminal.

[0110] When one of the first security level or the second security level triggers a designated security event, it indicates that the sensitive data may be stolen. At this time, a permission query for the access request may be generated according to the access attribute.

[0111] Furthermore, the communication terminal identifier bound to the user identifier, such as the mobile terminal bound to the user identifier, can be obtained from the preset address book, so that a permission query can be sent to the communication terminal corresponding to the communication terminal identifier to indicate whether the user corresponding to the communication terminal is allowed to access sensitive data.

[0112] After the user corresponding to the communication terminal responds to the permission query, the server may receive the response to the permission query returned by the communication terminal, and may then determine whether the verification is successful based on the response to the permission query.

[0113] In an embodiment of the present invention, upon receiving an access request for sensitive data sent by a user terminal, access attributes of the access request and sensitive attributes of the sensitive data are obtained, wherein the access attributes include access time and user identification, and then the permission information of the user identification for the sensitive data is determined, and the user intention for the user identification is determined using the permission information, the access time and the sensitive attributes, and historical operation data of the user identification is obtained from a preset database, and behavioral habit information for the user identification is determined based on the historical operation data; a first security level for the user identification is determined based on the user intention, the access time and the behavioral habit information, and log information of the sensitive data is obtained, and the user intention for the sensitive data is determined from the log information. According to the number of illegal accesses to the sensitive data, the log duration corresponding to the log information is divided into multiple preset periods according to a preset time interval, and the number of illegal accesses in each preset period is counted. According to the number of illegal accesses in each preset period, a second security level of the sensitive data is determined. According to the first security level and the second security level, a preset verification strategy is used to verify the user identification, and if the verification passes, the user identification is allowed to access the sensitive data. The security level of the access request is verified by analyzing the user intention of the user end that issues the access request, the access time and the behavioral habits to determine whether to allow access. This realizes data access control after account login, protects the security of sensitive data, and prevents criminals from stealing sensitive data after logging into the account.

[0114] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0115] Reference Figure 3 , which shows a schematic structural diagram of a data access control device provided by an embodiment of the present invention, which may specifically include the following modules:

[0116] The attribute module 301 is configured to, upon receiving an access request for sensitive data sent by a user terminal, obtain access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification;

[0117] A user intention module 302 is configured to determine permission information of the user identifier for the sensitive data, and determine the user intention for the user identifier using the permission information, the access time, and the sensitive attribute;

[0118] The behavior habit module 303 is used to obtain the historical operation data of the user identifier from a preset database, and determine the behavior habit information for the user identifier based on the historical operation data;

[0119] A security level module 304 is configured to determine a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtain log information of the sensitive data, and determine a second security level for the sensitive data based on the log information;

[0120] The verification module 305 is configured to verify the user identification using a preset verification strategy according to the first security level and the second security level, and allow the user identification to access the sensitive data if the verification passes.

[0121] In one embodiment of the present invention, the user intent module 302 may include:

[0122] A candidate operation item submodule, configured to determine, based on the permission information, a plurality of candidate operation items for the user identifier from a plurality of preset operation items;

[0123] a candidate operation item distribution information submodule, configured to determine candidate operation item distribution information of the plurality of candidate operation items within the sensitive period based on preset operation item distribution regularity data, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data;

[0124] A user intention submodule is configured to determine a target operation item from the multiple candidate operation items based on the access time and the candidate operation item distribution information, and determine a user intention for the user identifier based on the target operation item, wherein the user intention corresponds to the target operation item.

[0125] In one embodiment of the present invention, the behavior habit module 303 may include:

[0126] A candidate operation item habit information submodule is configured to collect statistics on the time habit information and frequency habit information of the user identifier for each candidate operation item based on the historical operation data;

[0127] The behavior habit information submodule is used to obtain the behavior habit information for the user identifier based on the time habit information and frequency habit information of each candidate operation item.

[0128] In one embodiment of the present invention, the security level module 304 may include:

[0129] An illegal access submodule, configured to determine the number of illegal accesses to the sensitive data from the log information;

[0130] A preset period statistics submodule is used to divide the log duration corresponding to the log information into a plurality of preset periods according to a preset time interval, and to count the number of illegal accesses in each preset period;

[0131] The second security level submodule is used to determine the second security level of the sensitive data according to the number of illegal accesses in each preset period.

[0132] In one embodiment of the present invention, the verification module 305 may include:

[0133] a face verification submodule, configured to send a face verification request to a user terminal corresponding to the user identifier when both the first security level and the second security level trigger a specified security event;

[0134] The facial image feature matching submodule is used to receive the real-time facial image returned by the user terminal in response to the facial verification request, and perform feature matching between the real-time facial image and a preset verification facial image.

[0135] In one embodiment of the present invention, the verification module 305 may include:

[0136] a permission query submodule, configured to generate a permission query for the access request based on the access attribute when one of the first security level and the second security level triggers a specified security event;

[0137] a permission inquiry sending submodule, configured to obtain a communication terminal identifier bound to the user identifier from a preset address book, and send the permission inquiry to the communication terminal corresponding to the communication terminal identifier;

[0138] The response receiving submodule is configured to receive a response to the permission inquiry returned by the communication terminal.

[0139] An embodiment of the present invention further provides an electronic device, which may include a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the above data access control method is implemented.

[0140] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above data access control method is implemented.

[0141] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0142] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0143] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1A step that specifies a function in one or more boxes.

[0147] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0148] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0149] The above describes in detail the provided data access control method and device, electronic device, and storage medium. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A method for data access control, characterized in that: The method comprises: Upon receiving an access request for sensitive data sent by a user terminal, obtaining access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification; Determining permission information of the user identifier for the sensitive data, and determining user intent for the user identifier using the permission information, the access time, and the sensitive attribute; Obtaining historical operation data of the user identifier from a preset database, and determining behavioral habit information for the user identifier based on the historical operation data; Determining a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtaining log information of the sensitive data, and determining a second security level for the sensitive data based on the log information; According to the first security level and the second security level, a preset verification strategy is used to verify the user identification, and if the verification passes, the user identification is allowed to access the sensitive data.

2. The method according to claim 1, characterized in that The sensitive attribute includes a sensitive period for the sensitive data, and the step of determining the user intention for the user identifier using the permission information, the access time, and the sensitive attribute includes: Determining, based on the permission information, a plurality of candidate operation items for the user identifier from a plurality of preset operation items; determining, according to preset operation item distribution regularity data, candidate operation item distribution information of the plurality of candidate operation items within the sensitive period, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data; A target operation item is determined from the plurality of candidate operation items according to the access time and the candidate operation item distribution information, and a user intention for the user identifier is determined according to the target operation item, wherein the user intention corresponds to the target operation item.

3. The method according to claim 2, characterized in that The step of determining the behavioral habit information for the user identifier based on the historical operation data includes: Based on the historical operation data, collecting time habit information and frequency habit information of the user identifier for each candidate operation item; Behavior habit information for the user identifier is obtained according to the time habit information and frequency habit information of each candidate operation item.

4. The method according to claim 1, wherein The step of determining the second security level of the sensitive data according to the log information includes: Determining the number of illegal accesses to the sensitive data from the log information; Divide the log duration corresponding to the log information into a plurality of preset periods according to a preset time interval, and count the number of illegal accesses in each preset period; A second security level of the sensitive data is determined according to the number of illegal accesses in each preset period.

5. The method according to claim 1 or 4, characterized in that The step of verifying the user identifier using a preset verification strategy according to the first security level and the second security level includes: When both the first security level and the second security level trigger a specified security event, sending a face verification request to the user terminal corresponding to the user identifier; Receive a real-time face image returned by the user terminal in response to the face verification request, and perform feature matching between the real-time face image and a preset verification face image.

6. The method according to claim 1 or 4, characterized in that The step of verifying the user identifier using a preset verification strategy according to the first security level and the second security level includes: generating a permission query for the access request based on the access attribute when one of the first security level and the second security level triggers a specified security event; Obtaining a communication terminal identifier bound to the user identifier from a preset address book, and sending the permission query to the communication terminal corresponding to the communication terminal identifier; A response to the permission inquiry returned by the communication terminal is received.

7. A data access control device, characterized in that: The device comprises: an attribute module, configured to, upon receiving an access request for sensitive data sent by a user terminal, obtain access attributes of the access request and sensitive attributes of the sensitive data, wherein the access attributes include access time and user identification; A user intention module, configured to determine permission information of the user identifier for the sensitive data, and determine the user intention for the user identifier using the permission information, the access time, and the sensitive attribute; A behavior habit module, configured to obtain historical operation data of the user identifier from a preset database, and determine behavior habit information for the user identifier based on the historical operation data; a security level module, configured to determine a first security level for the user identifier based on the user intention, the access time, and the behavioral habit information, obtain log information of the sensitive data, and determine a second security level for the sensitive data based on the log information; The verification module is used to verify the user identification using a preset verification strategy according to the first security level and the second security level, and allow the user identification to access the sensitive data if the verification passes.

8. The device according to claim 7, characterized in that The sensitive attribute includes a sensitive period for the sensitive data, and the user intent module includes: A candidate operation item submodule, configured to determine, based on the permission information, a plurality of candidate operation items for the user identifier from a plurality of preset operation items; a candidate operation item distribution information submodule, configured to determine candidate operation item distribution information of the plurality of candidate operation items within the sensitive period based on preset operation item distribution regularity data, wherein the operation item distribution regularity data is calculated based on historical sensitive data that is similar to or identical to the sensitive data; A user intention submodule is configured to determine a target operation item from the multiple candidate operation items based on the access time and the candidate operation item distribution information, and determine a user intention for the user identifier based on the target operation item, wherein the user intention corresponds to the target operation item.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the data access control method according to any one of claims 1 to 6 when executed by the processor.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for data access control according to any one of claims 1 to 6 is implemented.

Images