A method and device for automatically generating access control policies

Abstract

The method and device for automatically generating access control policies provided in the embodiments of the present invention rely on the machine learning algorithm of artificial intelligence to learn the communication traffic between the information access party and the information provider, and automatically generate access control policies. This can protect the security and stability of user access in a fine-grained, real-time, secure and intelligent manner, and ensure clear user rights and information access security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a method and device for automatically generating an access control strategy. Background Art

[0002] Access control technology refers to preventing unauthorized access to any resource, so that the computer system can be used within the legal scope. It means a technology that limits the user's access to certain information items or the use of certain control functions based on the user's identity and the defined group to which he belongs.

[0003] At present, the commonly used method is to divide power and domain and use scoring mechanism for hierarchical processing. These methods are single in technology, poor in defense, and cannot achieve dynamic control of authority. Summary of the invention

[0004] In view of this, in order to solve the above problems, the present invention provides a method and device for automatically generating access control policies. The technical solution is as follows:

[0005] A method for automatically generating an access control policy, the method comprising:

[0006] Obtain traffic data of communications between information access parties and information providers;

[0007] Determine a policy field of the access control policy to be generated, and merge the traffic data based on the policy field;

[0008] The merged data is learned using a machine learning algorithm to generate the access control policy.

[0009] Preferably, the method further comprises:

[0010] Performing data cleaning on the flow data to obtain first flow data for strategy generation;

[0011] Accordingly, the data merging of the traffic data based on the policy field includes:

[0012] The first traffic data is merged based on the policy field.

[0013] Preferably, the method further comprises:

[0014] The second flow data that has been cleaned and removed from the flow data is stored.

[0015] Preferably, the method further comprises:

[0016] Obtaining an identification result of a request initiated by the information access direction to the information provider based on the access control policy;

[0017] If the identification result is that the request is abnormal, security authentication is performed on the information accessing party.

[0018] Preferably, the method further comprises:

[0019] If the number of security authentications of the information accessing party is greater than a preset number threshold, the traffic data is updated, and the step of merging the traffic data based on the policy field is returned to update the access control policy.

[0020] An access control policy automatic generation device, the device comprising:

[0021] A data acquisition module is used to acquire traffic data of the communication between the information access party and the information provider;

[0022] A data processing module, used for determining a policy field of the access control policy to be generated, and merging the traffic data based on the policy field;

[0023] The policy generation module is used to use a machine learning algorithm to learn the merged data to generate the access control policy.

[0024] Preferably, the data processing module is also used for:

[0025] Performing data cleaning on the flow data to obtain first flow data for strategy generation;

[0026] Correspondingly, the data processing module for merging the traffic data based on the policy field is specifically used for:

[0027] The first traffic data is merged based on the policy field.

[0028] Preferably, the data processing module is also used for:

[0029] The second flow data that has been cleaned and removed from the flow data is stored.

[0030] Preferably, the device further comprises:

[0031] The security authentication module is used to obtain the identification result of the request initiated by the information access party to the information provider based on the access control policy; if the identification result is that the request is abnormal, the information access party is security authenticated.

[0032] Preferably, the device further comprises:

[0033] The policy update module is used to update the traffic data if the number of security authentications of the information access party is greater than a preset number threshold, and return to execute the step of merging the traffic data based on the policy field to update the access control policy.

[0034] The method and device for automatically generating access control policies provided in the embodiments of the present invention rely on the machine learning algorithm of artificial intelligence to learn the communication traffic between the information access party and the information provider, and automatically generate access control policies. This can protect the security and stability of user access in a fine-grained, real-time, secure and intelligent manner, and ensure clear user rights and information access security. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0036] Figure 1 A method flow chart of a method for automatically generating access control policies provided by an embodiment of the present invention;

[0037] Figure 2 A system architecture diagram for information access provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of access control policy management provided by an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of access control policy configuration provided by an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of another configuration of the access control policy provided by an embodiment of the present invention;

[0041] Figure 6 A schematic diagram of the structure of an automatic access control policy generation device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0044] The embodiment of the present invention provides a method for automatically generating an access control policy. The method flow chart of the method is as follows: Figure 1 As shown, the following steps are included:

[0045] S10, obtaining traffic data of the communication between the information access party and the information provider.

[0046] In the embodiment of the present invention, the information access party is a device that directly communicates with the information provider. The information access party may be a user terminal device or an intermediate device for forwarding access requests from user terminal devices, such as a company-level external communication device.

[0047] Also, see Figure 2 The system architecture diagram of information access shown in the figure includes a terminal device, a gateway and an application server. The terminal device is the information access party, and the application server is the information provider. The terminal device sends an access request to the application server through the gateway.

[0048] Among them, the gateway is an interception device that blocks the interaction between internal and external networks and application data. It is used to protect key assets (important basic equipment of the company's internal and external networks, website platforms, servers storing data, etc.). It allows terminal devices to access data only after establishing communication.

[0049] ASP stands for Access Control Studying Platform, which is set on the bypass side of the gateway. The automatic generation method of access control policy provided by the embodiment of the present invention can be applied to ASP. When the terminal device accesses the application server to perform various operations (such as the application accessed, and the operations such as deletion and entry performed on the application), it will be converted into traffic in the network, and these traffic will flow through the gateway. Therefore, ASP can collect all the traffic data of the communication between the terminal device and the application server, and dynamically generate access control policies based on machine learning technology.

[0050] S20, determining the policy fields of the access control policy to be generated, and merging the traffic data based on the policy fields.

[0051] In the embodiment of the present invention, the access control policies are divided into a first type of access control policies set for specific information access parties, and a second type of access control policies set for specific information providers.

[0052] For the first type of access control policy and the second type of access policy, the corresponding policy fields can be set respectively, and the policy fields include but are not limited to the access time, access address, trust score, browser used for access, etc.

[0053] Specifically, for the first type of access control policy, part of the traffic data corresponding to a specific information access party can be filtered out from the traffic data, and the field content of the specific information access party under the corresponding policy field can be further extracted from the part of the traffic data, thereby obtaining multiple data groups of the specific information access party, each data group containing a set of field contents under a policy field.

[0054] Taking the policy fields including user name, access time, browser used for access, access location, real-time monitoring risk score, and whether cloud desktop access is used as an example, each data group of the specific information access party contains a set of field contents under the above policy fields, and data merging is to merge at least two data groups with exactly the same content into one data group, thereby reducing unnecessary samples for machine learning.

[0055] For the second type of access control policy, part of the traffic data corresponding to a specific information provider can be filtered out from the traffic data, and the field content of the specific information provider under the corresponding policy field can be further extracted from the part of the traffic data. In this way, multiple data groups of multiple information access parties that access the specific information provider can be obtained. Similarly, each data group contains the field content of the corresponding information access party under a set of policy fields.

[0056] Similarly, for multiple data groups of each information access party, the data can be merged, and at least data groups with exactly the same content can be merged into one data group, which can correspondingly reduce unnecessary samples for machine learning.

[0057] In some other embodiments, in order to reduce the amount of data processing for data merging, the embodiments of the present invention further include the following steps:

[0058] Performing data cleaning on the flow data to obtain first flow data for strategy generation;

[0059] Accordingly, in step S20, “merging traffic data based on policy fields” includes:

[0060] The first traffic data is merged based on the policy field.

[0061] In addition to the useful traffic data required for generating access control policies, the traffic data also includes useless traffic data such as heartbeat connections. In this regard, in an embodiment of the present invention, the traffic data collected in step S10 can be preliminarily cleaned to obtain useful traffic data, such as the request content of the information access party, the response content returned by the information provider based on the request content of the information access party, the local environment information of the information access party (for real-time monitoring of risks), and the configuration information of the information provider (such as role and permission configuration).

[0062] In addition, in order to improve data utilization, the embodiment of the present invention can also store the second flow data that has been cleaned and removed from the flow data. Specifically, it can be stored in a database to enable subsequent secondary analysis of these data to obtain valuable content.

[0063] S30, using a machine learning algorithm to learn the merged data to generate an access control policy.

[0064] In the embodiment of the present invention, the basic model of the access control policy dynamic model can be customized, and then the first part of the merged data is input into the basic model as a sample, and the basic model is trained for data matching, so as to gradually improve the recognition accuracy of the basic model. Then, the trained model is tested and evaluated, and the parameters of the model are fine-tuned by calculating the accuracy, recall rate or F value of the model, so as to obtain the final access control policy dynamic model.

[0065] The merged second part of data is input into the access control policy dynamic model to output the corresponding access control policy through the access control policy dynamic model. Since the data merging is performed based on the policy field of the access control policy, the generated access control policy can reflect the normal behavior of the information visitor under the corresponding policy field. Therefore, the ASP can be connected in series to the gateway to perform dynamic access policy control.

[0066] For example, for work applications, the common access time is 8:00-20:00 on weekdays. If a user accesses the application on non-working days or non-working hours, it can be recorded as a high-risk abnormal operation. For another example, for banking OA systems, the default compatibility with IE browsers is achieved. If a user abnormally accesses the application using other browser addresses during long-term use, the user must be prohibited from accessing the application.

[0067] See also Figure 3 The access control policy management diagram shown in the figure shows that the administrator can view the relevant information of each access control policy and adjust its status (enable / disable). Figure 4 The access control policy configuration diagram shown in the figure shows that the administrator can configure the corresponding department / user group / device group for the target access control policy. Figure 5 Another configuration diagram of the access control policy is shown. After selecting the department / user group / device group corresponding to the target access control policy, you can continue to view the normal range of each policy field of the target access control policy. The trust score is the real-time monitoring risk score, which can be obtained by evaluating the local environment information of the information access party using existing software.

[0068] In some other embodiments, in order to achieve flexibility in access control, the embodiments of the present invention further include the following steps:

[0069] Obtain the identification result of the request initiated by the information access party to the information provider based on the access control policy; if the identification result is that the request is abnormal, perform security authentication on the information access party.

[0070] In the embodiment of the present invention, if the access control policy identifies that the request of the information access party is abnormal, that is, its access operation is an abnormal high-risk abnormal operation, the information access party can be subjected to security verification, such as mobile phone verification code or face verification. If the security verification fails, the access operation of the information access party is prohibited.

[0071] If the information access party fails the security verification multiple times, the authority of the information access party can be dynamically adjusted to reduce the scope of its authority to reduce the access ability of the information access party. In this way, the authority of the information access party can be dynamically adjusted to adapt to the access environment and improve data access security.

[0072] On this basis, if the number of security authentications of the information access party is greater than the preset number threshold, that is, the information access party has passed multiple security authentications, this means that the access control policy can no longer adapt to the current access environment and needs to be updated. Therefore, the embodiment of the present invention can re-acquire the traffic data, re-execute the data merging, and update the access control policy.

[0073] The method for automatically generating access control policies provided in the embodiment of the present invention relies on an artificial intelligence machine learning algorithm to learn the communication traffic between the information access party and the information provider, and automatically generates access control policies. This can protect the security and stability of user access in a fine-grained, real-time, secure, and intelligent manner, and ensure clear user rights and information access security.

[0074] Based on the access control policy automatic generation method provided in the above embodiment, the embodiment of the present invention provides a device for executing the access control policy automatic generation method. The structural diagram of the device is shown in FIG. Figure 6 As shown, including:

[0075] The data acquisition module 10 is used to acquire the traffic data of the communication between the information access party and the information provider;

[0076] The data processing module 20 is used to determine the policy field of the access control policy to be generated, and to merge the traffic data based on the policy field;

[0077] The policy generation module 30 is used to learn the merged data using a machine learning algorithm to generate an access control policy.

[0078] Optionally, the data processing module 20 is further used for:

[0079] Performing data cleaning on the flow data to obtain first flow data for strategy generation;

[0080] Accordingly, the data processing module 20 for merging the traffic data based on the policy field is specifically used for:

[0081] The first traffic data is merged based on the policy field.

[0082] Optionally, the data processing module 20 is further used for:

[0083] The second flow data that has been cleaned and removed from the flow data is stored.

[0084] Optionally, the above device further comprises:

[0085] The security authentication module is used to obtain the identification result of the request initiated by the information access direction to the information provider based on the access control policy; if the identification result is that the request is abnormal, the information access party is security authenticated.

[0086] Optionally, the above device further comprises:

[0087] The policy update module is used to update the traffic data if the number of security authentications of the information access party is greater than a preset number threshold, and return to execute the step of merging the traffic data based on the policy field to update the access control policy.

[0088] It should be noted that the functions of each module in the embodiment of the present invention can be found in the corresponding disclosed part of the above method embodiment, and will not be repeated here.

[0089] The access control policy automatic generation device provided in the embodiment of the present invention relies on the machine learning algorithm of artificial intelligence to learn the communication traffic between the information access party and the information provider, and automatically generates access control policies. This can protect the security and stability of user access in a fine-grained, real-time, secure and intelligent manner, and ensure clear user rights and information access security.

[0090] The above is a detailed introduction to a method and device for automatically generating an access control policy provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0091] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0092] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device that includes a series of elements is inherent to the elements, or also includes elements inherent to these processes, methods, articles or devices. In the absence of further restrictions, the elements defined by the sentence "including a..." do not exclude the presence of other identical elements in the process, method, article or device that includes the elements.

[0093] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0094] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0095] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for automatically generating an access control policy, characterized in that: The method comprises: Acquire traffic data of communication between the information access party and the information provider, wherein the traffic data is various operations performed by the information access party when accessing the information provider; Determine a policy field of the access control policy to be generated, and merge the traffic data based on the policy field; Among them, the policy field of the access control policy to be generated is determined, and the traffic data is merged based on the policy field, including: the access control policy is divided into a first type of access control policy set for a specific information access party, and a second type of access control policy set for a specific information provider; for the first type of access control policy, part of the traffic data corresponding to the specific information access party is screened from the traffic data, and the field content of the specific information access party under the corresponding policy field is extracted from the part of the traffic data corresponding to the specific information access party, and multiple data groups of the specific information access party are obtained, each of the multiple data groups of the specific information access party contains a group of field contents under the policy field. , and merge at least two data groups with the same field content under the set of policy fields into one data group; for the second type of access control policy, filter part of the traffic data corresponding to a specific information provider from the traffic data, and extract the field content of the specific information provider under the corresponding policy field from the part of the traffic data corresponding to the specific information provider, obtain multiple data groups of multiple information access parties accessing the specific information provider, each of the multiple data groups of the multiple information access parties of the specific information provider contains the field content of the corresponding information access party under a set of policy fields, and merge at least two data groups with the same field content of the corresponding information access party under a set of policy fields into one data group; Using a machine learning algorithm to learn the merged data to generate the access control policy; Obtain an identification result of the request initiated by the information access party to the information provider based on the access control policy; if the identification result is an abnormal request, perform security authentication on the information access party, if the number of security authentications of the information access party is greater than a preset number threshold, indicating that the access control policy cannot adapt to the current access environment, update the traffic data, and return to execute the step of merging the traffic data based on the policy field to update the access control policy.

2. The method according to claim 1, characterized in that The method further comprises: Performing data cleaning on the flow data to obtain first flow data for strategy generation; Accordingly, the data merging of the traffic data based on the policy field includes: The first traffic data is merged based on the policy field.

3. The method according to claim 2, characterized in that The method further comprises: The second flow data that has been cleaned and removed from the flow data is stored.

4. An automatic access control policy generation device, characterized in that: The device comprises: A data acquisition module, used to acquire traffic data of the communication between the information access party and the information provider, wherein the traffic data is various operations performed by the information access party when accessing the information provider; A data processing module, used for determining a policy field of the access control policy to be generated, and merging the traffic data based on the policy field; Wherein, the data processing module is specifically used for: the access control policy is divided into a first type of access control policy set for a specific information access party, and a second type of access control policy set for a specific information provider; for the first type of access control policy, a part of the traffic data corresponding to the specific information access party is screened from the traffic data, and the field content of the specific information access party under the corresponding policy field is extracted from the part of the traffic data corresponding to the specific information access party to obtain multiple data groups of the specific information access party, each of the multiple data groups of the specific information access party contains a set of field contents under a policy field, and the field contents under the set of policy fields are extracted. At least two identical data groups are merged into one data group; for the second type of access control policy, part of the traffic data corresponding to a specific information provider is screened from the traffic data, and the field content of the specific information provider under the corresponding policy field is extracted from the part of the traffic data corresponding to the specific information provider, to obtain multiple data groups of multiple information access parties that access the specific information provider, each of the multiple data groups of the multiple information access parties of the specific information provider containing the field content of the corresponding information access party under a set of policy fields, and at least two data groups with the same field content of the corresponding information access party under a set of policy fields are merged into one data group; A policy generation module, used to learn the merged data using a machine learning algorithm to generate the access control policy; A security authentication module, used to obtain an identification result of a request initiated by the information access party to the information provider based on the access control policy; if the identification result is that the request is abnormal, security authentication is performed on the information access party; The policy update module is used to update the traffic data if the number of security authentications of the information access party is greater than a preset number threshold, and return to execute the step of merging the traffic data based on the policy field to update the access control policy.

5. The device according to claim 4, characterized in that The data processing module is also used for: Performing data cleaning on the flow data to obtain first flow data for strategy generation; Correspondingly, the data processing module for merging the traffic data based on the policy field is specifically used for: The first traffic data is merged based on the policy field.

6. The device according to claim 5, characterized in that The data processing module is also used for: The second flow data that has been cleaned and removed from the flow data is stored.

Images