Access control method, device, equipment and storage medium

Abstract

The embodiment of the present application discloses an access control method, apparatus, device and storage medium, the method comprising: obtaining operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data comprises operation time, operation frequency and operation content; analyzing the operation behavior data to calculate the operation time risk value, operation frequency risk value and operation content risk value; calculating the operation risk of the access operation according to the operation time risk value, operation frequency risk value and operation content risk value; controlling the access operation according to the operation risk. The technical solution of the embodiment of the present application reduces the probability of operation by non-users themselves, effectively increases the security of access and the confidentiality of data information.

Description

Technical Field

[0001] The present application relates to the field of computer technology and provides an access control method, an access control device, an electronic device and a computer-readable storage medium. Background Art

[0002] Database security protection includes the protection of the operating system and information security. The threats to system security are usually as follows: hackers invade the database and steal the desired information. The security features of the database system are mainly for data. Nowadays, there are many ways to protect database information security. Common protection methods are to use data encryption technology, set database access rights for users, and verify user input information. However, there are many problems with this method:

[0003] Set user access rights: Users with high-privilege accounts are also at risk of being hacked and their accounts stolen, resulting in data leakage or deletion of key information and other adverse operations, and it is impossible to determine whether the current operator is the user himself.

[0004] Verification of input information such as account and password: It is only a verification of data information, which can also prevent security risks such as Structured Query Language (SQL) injection, but it is impossible to determine whether the current operation is performed by the user himself. If the account is leaked, the database can still be operated normally to query relevant important information. Summary of the invention

[0005] The purpose of the present application is to provide an access control method, an access control device, an electronic device and a computer-readable storage medium, which reduce the probability of non-user operations and effectively increase the security of access and the confidentiality of data information.

[0006] The present application proposes an access control method, which includes: obtaining operation behavior data corresponding to an access operation of a user belonging to a client, wherein the operation behavior data includes operation time, operation frequency and operation content; analyzing the operation behavior data to calculate an operation time risk value, an operation frequency risk value and an operation content risk value; calculating the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value; and controlling the access operation according to the operation risk.

[0007] Furthermore, the analysis of the operation behavior data to calculate the operation time risk value, the operation frequency risk value and the operation content risk value includes: calculating the operation time risk value based on the operation time; calculating the operation frequency risk value based on the operation frequency; calculating the operation content risk value based on the operation time risk value, the operation frequency risk value and the operation content.

[0008] Furthermore, calculating the operation time risk value based on the operation time includes: obtaining at least two time periods divided based on the historical operation frequency of the user's historical access operations, and the risk value corresponding to each time period; matching the operation time with the at least two time periods to obtain the risk value corresponding to the matched time period; and obtaining the operation time risk value based on the risk value corresponding to the matched time period.

[0009] Furthermore, the operation frequency is the frequency within the most recent time period including the operation time, and the calculation of the operation frequency risk value based on the operation frequency includes: obtaining the total number of operations of the user in the historical time period; dividing the historical time period into multiple time periods to calculate the average historical operation frequency in each time period; and calculating the operation frequency risk value based on the average historical operation frequency in each time period and the operation frequency.

[0010] Furthermore, the calculation of the operation content risk value based on the operation time risk value, the operation risk value and the operation content includes: obtaining multiple operation types obtained by classifying the historical operation content of the user, and the risk value corresponding to each operation type; determining the target operation type corresponding to the operation content to obtain the risk value corresponding to the target operation type; calculating the operation content risk value based on the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type.

[0011] Furthermore, the calculation of the operation content risk value based on the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type includes: obtaining a first weight and a second weight corresponding to the operation time risk value and the operation frequency risk value, respectively; weighting the operation time risk value and the operation frequency risk value to obtain a weighted risk value based on the first weight and the second weight; and calculating the operation content risk value based on the weighted risk value and the risk value corresponding to the target operation type.

[0012] Furthermore, the calculation of the operational risk of the access operation based on the operation time risk value, the operation frequency risk value and the operation content risk value includes: obtaining a first weight, a second weight and a third weight corresponding to the operation time risk value, the operation frequency risk value and the operation content risk value respectively, wherein the value of the first weight is less than the value of the second weight, and the value of the second weight is less than the third weight value; performing weighted sum processing on the operation time risk value, the operation frequency risk value and the operation content risk value according to the first weight, the second weight and the third weight to obtain the operational risk.

[0013] The present application also proposes an access control device, which includes: an acquisition module, used to obtain operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes operation time, operation frequency and operation content; an analysis module, used to analyze the operation behavior data to calculate an operation time risk value, an operation frequency risk value and an operation content risk value; a calculation module, used to calculate the operation risk of the access operation based on the operation time risk value, the operation frequency risk value and the operation content risk value; and a control module, used to control the access operation based on the operation risk.

[0014] The present application also proposes an electronic device, which includes: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the method described above.

[0015] The present application also proposes a computer-readable storage medium on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the method as described above.

[0016] Compared with the prior art, this application has the following beneficial effects:

[0017] In the technical solution provided by the present application, the operation behavior data corresponding to the access operation of the user to which the client belongs is obtained, and then the operation behavior data is analyzed to calculate the operation time risk value, the operation frequency risk value and the operation content risk value, and then the risk values ​​of the three dimensions are combined to obtain the operation risk of the end user's access operation, thereby ensuring the accuracy of the operation risk determination, and controlling the access operation based on the operation risk, further reducing the probability of operations not performed by the user himself, and effectively increasing the security of access and the confidentiality of data information. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram showing an implementation environment involved in the present application is shown;

[0019] Figure 2 A flowchart of an access control method shown in an exemplary embodiment of the present application is shown;

[0020] Figure 3 Shows Figure 2 The flowchart of step S120 in the illustrated embodiment in an exemplary embodiment;

[0021] Figure 4 Shows Figure 3 A flowchart of step S121 in the illustrated embodiment in an exemplary embodiment;

[0022] Figure 5 Shows Figure 3 A flowchart of step S122 in the illustrated embodiment in an exemplary embodiment;

[0023] Figure 6 Shown in Figure 3 A flowchart of step S123 in the illustrated embodiment in an exemplary embodiment;

[0024] Figure 7 Shows Figure 6 A flowchart of step S1233 in the illustrated embodiment in an exemplary embodiment;

[0025] Figure 8 Shows Figure 2 A flowchart of step S131 in the illustrated embodiment in an exemplary embodiment;

[0026] Fig. 9 A flowchart of another access control method shown in an exemplary embodiment of the present application is shown;

[0027] Fig.10 A schematic diagram of the structure of an access control device shown in an exemplary embodiment of the present application is shown;

[0028] Fig.11 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application is shown. DETAILED DESCRIPTION

[0029] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0031] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0032] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0033] See also Figure 1 , Figure 1 1 is a schematic diagram of an implementation environment involved in the present application. The implementation environment includes a client 10 and a server 20. The client 10 and the server 20 can be connected via a network 30. The network 30 can be a wired network or a wireless network, which is not limited here.

[0034] A database runs on the server 20 .

[0035] The client 10 is used to access the database on the server 20 to operate the data in the database.

[0036] The server 20 is used to obtain operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes operation time, operation frequency and operation content; analyze the operation behavior data to calculate an operation time risk value, an operation frequency risk value and an operation content risk value; calculate the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value; and control the access operation according to the operation risk, for example, determining whether to respond to the access operation according to the operation risk.

[0037] In some embodiments, the access control method can also be implemented by the client alone, that is, a database is run on the client to obtain the operation behavior data corresponding to the user's access operation, obtain the operation risk of the access operation, and then control the access operation based on the operation risk.

[0038] Among them, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network) and big data and artificial intelligence platforms. This section does not impose any restrictions on this.

[0039] Clients include but are not limited to smartphones, tablets, laptops, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc.

[0040] The following is based on Figure 1 The implementation environment shown details the access control approach:

[0041] See also Figure 2 , Figure 2 is a flowchart of an access control method shown in an exemplary embodiment of the present application. The access control method is composed of Figure 1 The server shown in the figure performs the access control method, which includes steps S110 to S140, which are described in detail as follows:

[0042] S110: Acquire operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes operation time, operation frequency and operation content.

[0043] In an embodiment of the present application, a user can access a database on a server based on a client, and the server can obtain the user's access operation. It can be understood that the access operation corresponds to operation behavior data, which refers to the behavior data involved in the access operation, including operation time, operation frequency and operation content.

[0044] The operation time refers to the triggering moment corresponding to the access operation. For example, when the current access operation is a query operation, the operation time is the moment of the triggered query operation. For example, an input box and a query button are displayed on the display interface. After information is entered into the input box, the user clicks the query button to trigger the query operation. The query time of clicking the query button is used as the operation time. For example, when the current access operation is a login operation to log in to a database, the operation time is the login time.

[0045] The operation frequency refers to the frequency of operations within a certain time period, which includes the operation time. The operation within the certain time period can be any operation. For example, if the query time is 12:00, the operation frequency is the frequency based on all operations between 11:00 and 12:00. All operations can be query operations, login operations, data modification operations, data update operations, etc.

[0046] The operation content refers to the content of the database operated after logging into the database. For example, the operation content of the query operation is to query the specified data, the operation content of the data modification operation is to modify the A data in the database to the B data; the data update operation is to update the C data in the database to the D data.

[0047] It should be noted that before obtaining the operation behavior data corresponding to the access operation of the user belonging to the client, the user login information can also be verified, that is, the account and password entered by the user can be verified. Only when the verification is passed, the user is allowed to access the data in the database. At this time, the operation content is obtained.

[0048] S120: Analyze the operation behavior data to calculate the operation time risk value, the operation frequency risk value, and the operation content risk value.

[0049] In an embodiment of the present application, the operation behavior data may be analyzed, specifically the operation time, operation frequency and operation content, to calculate the operation time risk value, the operation frequency risk value and the operation content risk value.

[0050] Among them, the operation time risk value is used to characterize the risk level of the operation time for the access operation, the operation frequency value is used to characterize the risk level of the operation frequency for the access operation, and the operation content risk value is used to characterize the risk level of the operation content for the access operation.

[0051] It is worth noting that Figure 3 As shown, Figure 3 Shows Figure 2 The flowchart of step S120 in the illustrated embodiment includes:

[0052] S121. Calculate the operation time risk value according to the operation time.

[0053] S122. Calculate the operation frequency risk value according to the operation frequency.

[0054] S123. Calculate the operation content risk value according to the operation time risk value, the operation frequency risk value and the operation content.

[0055] Since the operation behavior data includes operation time, operation frequency and operation content, the operation time risk value can be calculated based on the operation time, and the operation frequency risk value can be calculated based on the operation frequency. The operation content risk value and the operation time are related to the operation frequency. For example, the operation time is 12 o'clock in the morning, and the operation frequency is 60 times in 1 minute. The operation frequency is relatively high, which means that the access operation at this time is relatively abnormal, and the corresponding operation content risk value is also high. Therefore, the operation content risk value can be calculated based on the operation time risk value, the operation frequency risk value and the operation content, so that the obtained operation content risk value is more accurate.

[0056] In some embodiments, Figure 4 As shown, Figure 4 Shows Figure 3 In the flowchart of step S121 in the illustrated embodiment, the process of calculating the operation time risk value includes:

[0057] S1211. Obtain at least two time periods divided based on the historical operation frequency of the user's historical access operations, and a risk value corresponding to each time period.

[0058] In an embodiment of the present application, the historical access operations of each user are recorded in advance, and the preset time period is divided into at least two time periods based on the historical operation frequency of the user's historical access operations, wherein the preset time period includes but is not less than 24 hours, 7 days a week, 30 days a month, etc.

[0059] Dividing the preset time period based on the historical operation frequency may be clustering the historical operation frequencies, and dividing the preset time period according to the clustering results. For example, if the preset time period is 24 hours, and the historical operation frequency is that the operation frequency is higher from 8 to 17 o'clock, the operation frequency is lower from 17 to 23 o'clock, and the operation frequency is almost non-existent from 23 to 24 o'clock, then the 24 hours may be divided into a time period from 8 to 17 o'clock, a time period from 17 to 23 o'clock, and a time period from 23 to 24 o'clock.

[0060] Optionally, after at least two time periods are divided, in order to facilitate distinction, the time period from 8 to 17 o'clock can be used as a working time period, the time period from 17 to 23 o'clock can be used as a non-working time period, and the time period from 23 to 24 o'clock can be used as a no-login time period.

[0061] In the embodiment of the present application, after at least two time periods are divided, a corresponding risk value can be configured for each time period, for example, the time period corresponding to a higher operation frequency (working time period) has a first risk value; the time period corresponding to a lower operation frequency (non-working time period) has a second risk value; the time period with almost no operation frequency (no login time period) has a third risk value, and the first risk value is less than the second risk value, and the second risk value is less than the third risk value. Optionally, the size of the corresponding risk value configured for each time period is [0,1].

[0062] It is understandable that for different users, the at least two time periods divided should be different, and the risk values ​​corresponding to the time periods should also be different, which is not limited here.

[0063] Furthermore, at least two time periods corresponding to each user and the risk value corresponding to each time period can be obtained. Therefore, when obtaining the operation behavior data of user A belonging to the client, at least two time periods corresponding to user A and the risk value corresponding to each time period can be obtained first.

[0064] S1212. Match the operation time with at least two time periods to obtain risk values ​​corresponding to the matched time periods.

[0065] Since the operation behavior data of user A belonging to the client includes the operation time, the operation time of user A is matched with at least two time periods corresponding to user A. Assuming that a non-working time period is matched, the risk value corresponding to the non-working time period is further obtained, that is, the second risk value.

[0066] S1213. Obtain the operation time risk value according to the risk value corresponding to the matched time period.

[0067] In an example of an embodiment of the present application, the risk value corresponding to the matched time period may be used as the operation time risk value.

[0068] In another example, the risk value corresponding to the matched time period may be converted and the converted value may be used as the operation time risk value. For example, the risk value corresponding to the matched time period may be multiplied by a preset weight and the resulting value may be used as the operation time risk value.

[0069] In an embodiment of the present application, the time period is divided according to the user's historical operation time to obtain an operation time risk value, so that the operation time risk value is updated to fit the user's actual situation, thereby facilitating determination of whether the operation corresponding to the current operation time is performed by the user himself.

[0070] It should be noted that the operation frequency in the embodiment of the present application is the frequency within the most recent time period including the operation time. The time period can be flexibly adjusted according to the actual situation. For example, if the time period is 1 hour and the operation time is 9:00, the operation frequency is the frequency within the most recent 1 hour including the operation time. Figure 5 As shown, Figure 5 Shows Figure 3 In the flowchart of step S122 in the illustrated embodiment, the process of calculating the operating frequency risk value includes:

[0071] S1221. Obtain the total number of operations of the user in a historical time period.

[0072] In the embodiment of the present application, the historical time period can be flexibly adjusted according to actual needs. For example, if the historical time period is the last 24 hours of a day, the total number of operations of the user in the last 24 hours is obtained.

[0073] S1222. Divide the historical time period into multiple time periods to calculate the average historical operation frequency in each time period.

[0074] As mentioned above, the operation frequency is the frequency within the most recent time period including the operation time. For example, if the operation frequency is the frequency within the most recent hour including the operation time, 24 hours can be divided into 24 time periods to calculate the historical average operation frequency per hour.

[0075] S1223. Calculate the operation frequency risk value based on the average historical operation frequency and the operation frequency in each time period.

[0076] In the embodiment of the present application, the operation frequency risk value is calculated based on the average historical operation comments in each time period and the most recent time period. The calculation formula is as follows:

[0077]

[0078] Among them, E(X) is the average historical operation frequency in each time period, X T is the operating frequency, K is the preset upper limit of the operating frequency, and the value of K can be flexibly adjusted according to actual conditions. For example, if K is 1000, it means that the maximum operating frequency of the user is 1000.

[0079] In the embodiment of the present application, the operation frequency change characteristics are reflected by averaging the historical operation frequency in each time period and the operation frequency in the most recent time period, and then the operation frequency risk value is calculated to facilitate the subsequent determination of whether the operation is performed by the user himself.

[0080] like Figure 6 As shown, Figure 6 Shows Figure 3 In the flowchart of step S123 in the illustrated embodiment, the process of calculating the risk value of the operation content includes:

[0081] S1231. Acquire multiple operation types obtained by classifying the historical operation contents of the user, and the risk value corresponding to each operation type.

[0082] In the embodiment of the present application, the historical operation content of each user's historical access operation is recorded in advance, and the historical operation content is classified to obtain multiple operation types, wherein the operation types include insert operation (insert), delete operation (Delete), select operation (Select), update operation (Update), terminate operation (drop) and modify operation (Alter).

[0083] After multiple operation types are obtained through classification, it is necessary to configure a corresponding risk value for each operation type. Optionally, the size of the corresponding risk value configured for each operation type is [0,1].

[0084] In one example, a corresponding risk value can be configured for each operation type according to the user's operating habits. For example, the user's operating habit is to select data first, that is, first perform the selection operation and then cancel the selection operation; the user's operating habit also includes almost no termination operation, then the risk value of the selection operation is less than that of the termination operation.

[0085] In another example, the corresponding risk value may be configured according to the user's operation frequency of each operation type. The higher the operation frequency of the operation type, the lower the corresponding risk value.

[0086] It is understandable that different users should be classified into different operation types, and the risk values ​​corresponding to the operation types should also be different, which is not limited here.

[0087] Then, multiple operation types corresponding to each user and the risk value corresponding to each operation type can be obtained. Therefore, when obtaining the operation behavior data of user A belonging to the client, multiple operation types corresponding to user A and the risk value corresponding to each operation type can be obtained first.

[0088] S1232. Determine the target operation type corresponding to the operation content to obtain a risk value corresponding to the target operation type.

[0089] Since the operation behavior data of user A belonging to the client includes the operation content, the corresponding target operation type is first determined based on the operation content. For example, if the operation content is to modify data C to data D, the target operation type is the modification operation, and the risk value corresponding to the modification operation will be obtained.

[0090] S1233. Calculate the operation content risk value according to the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type.

[0091] In an embodiment of the present application, since the operation content risk value and operation time are related to the operation frequency and the operation content, after obtaining the risk value corresponding to the target operation type, the operation content risk value is calculated based on the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type.

[0092] In the embodiment of the present application, the risk value of the current operation content is determined by comparing the user's historical operation content with the current operation content, so as to facilitate the subsequent determination of whether the operation is performed by the user himself.

[0093] Among them, Figure 7 Shows Figure 6 In the flowchart of step S1233 in the illustrated embodiment, the process of calculating the risk value of the operation content includes:

[0094] S710. Obtain a first weight and a second weight corresponding to the operation time risk value and the operation frequency risk value respectively.

[0095] In an embodiment of the present application, a first weight and a second weight are pre-configured for the operation time risk value and the operation frequency risk, wherein the first weight is smaller than the second weight.

[0096] S720. Perform weighted processing on the operation time risk value and the operation frequency risk value according to the first weight and the second weight to obtain a weighted risk value.

[0097] In one example, weighted processing of the operation time risk value and the operation frequency risk value according to the first weight and the second weight may be weighted average processing, that is, (first weight*operation time risk value+second weight*operation frequency risk value) / (first weight+second weight).

[0098] In another example, the weighted processing of the operation time risk value and the operation frequency risk value according to the first weight and the second weight may be weighted sum processing, that is, first weight*operation time risk value+second weight*operation frequency risk value.

[0099] S730. Calculate the operation content risk value according to the weighted risk value and the risk value corresponding to the target operation type.

[0100] In one example, the product of the weighted risk value and the risk value corresponding to the target operation type may be used as the operation content risk value.

[0101] In another example, the sum of the weighted risk value and the risk value corresponding to the target operation type may be used as the operation content risk value.

[0102] S130. Calculate the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value.

[0103] In the embodiment of the present application, the operational risk of the access operation is calculated from three dimensions: operation time risk value, operation frequency risk value and operation content risk value. The operational risk of the access operation is used to characterize the risk level of the access operation.

[0104] like Figure 8 Shows Figure 2 In the flowchart of step S130 in the illustrated embodiment, the process of calculating the operational risk of the access operation includes:

[0105] S131. Obtain the first weight, second weight and third weight corresponding to the operation time risk value, the operation frequency risk value and the operation content risk value respectively, wherein the value of the first weight is smaller than the value of the second weight, and the value of the second weight is smaller than the value of the third weight.

[0106] In the embodiments of the present application, Figure 8 The first and second weights in Figure 7 The first and second weights in are the same. Figure 8 The third weight corresponding to the risk value of the operation content is also included. The value of the third weight is the largest, indicating that the risk value of the operation content is the most important.

[0107] S132. Perform weighted sum processing on the operation time risk value, the operation frequency risk value, and the operation content risk value according to the first weight, the second weight, and the third weight to obtain the operation risk.

[0108] In an embodiment of the present application, the first weight and the operation time risk value are multiplied, the second weight and the operation frequency risk value are multiplied, and the third weight and the operation content risk value are multiplied. Finally, the products are added together to obtain the operational risk. By combining the risks and weights of the three dimensions, the operational risk of the end user's operation on the database access is derived, making the determination of the operational risk more accurate and reliable.

[0109] S140: Control the access operation according to the operation risk.

[0110] Continue to see Figure 2 In an embodiment of the present application, the access operation can be controlled by the operational risk, such as determining whether to respond to the access operation based on the operational risk, or determining whether to issue an early warning based on the operational risk.

[0111] Among them, after obtaining the operation risk, the operation risk can be compared with the preset risk value. If the operation risk is greater than or equal to the preset risk value, it indicates that the current access operation is not initiated by the user himself, and the access operation is rejected; if the operation risk is less than the preset risk value, it indicates that the operation is initiated by the user himself, and the access operation is responded to.

[0112] In an embodiment of the present application, the operation behavior data corresponding to the access operation of the user to which the client belongs is obtained, and then the operation behavior data is analyzed to calculate the operation time risk value, the operation frequency risk value and the operation content risk value, and then the risk values ​​of the three dimensions are combined to obtain the operation risk of the end user's access operation, thereby ensuring the accuracy of the operation risk determination, and controlling the access operation based on the operation risk, further reducing the probability of operations not performed by the user himself, and effectively increasing the security of access and the confidentiality of data information.

[0113] For ease of understanding, this embodiment uses a more specific example to illustrate the access control method. The access control method aims to analyze the behavior characteristics of users in different dimensions such as operation time, operation frequency, and operation content, and use a unique calculation method to obtain the risk of this operation behavior, and use the execution result to determine whether this access operation has risks, further reducing the probability of non-user operations, and effectively increasing the security of access and the confidentiality of data information. Fig. 9 As shown, the access control method includes:

[0114] S910: A user initiates a request.

[0115] When a user needs to access the database, he needs to initiate a request, that is, the user initiates a request to verify login information such as the login account and password.

[0116] S920: Verify login information.

[0117] The server corresponding to the database will verify the login account and password, that is, verify whether the login account and password are correct.

[0118] S930: Verify the query information input by the user.

[0119] After the user successfully logs in, the server corresponding to the database will first verify the query information entered by the user (i.e. the aforementioned access operation) to determine whether there are illegal fields or malicious operations or malicious input behaviors in the query information. The server corresponding to the database pre-stores an illegal field set, and then the query information can be verified based on the illegal field set. Malicious operations include but are not limited to repeatedly entering query information, deleting query information, and repeatedly executing it.

[0120] In one example, the input query information can also be subjected to string verification, keyword screening, and regular expression verification, wherein string verification includes but is not limited to verifying whether the string is empty and whether the string length meets the requirements; keyword screening includes but is not limited to checking the number, length, and repetition rate of keywords; regular expression verification refers to matching the target string through a regular expression, and the target string can be an abnormal string or a normal string.

[0121] S940. Operational risk determination.

[0122] In the embodiment of the present application, after the query information input by the user is verified, the query behavior information is accepted, and the operational risk is determined based on the query behavior information.

[0123] First, preprocess the data:

[0124] 1) Extract historical user login information, including login times and login time periods; 2) Classify historical user operations to obtain the types of operations (Delete, Select, Update, Insert, Drop, Alter); 3) Count the frequency of user operations on the database.

[0125] Then perform data analysis:

[0126] According to the frequency of user operations on the database, 24 hours is divided into three actual segments, namely working hours, non-working hours and no login time period, and the label set is obtained as <t w ,t n ,t i >.

[0127] Count the average number of queries to the database in one hour E(X) and calculate the operation frequency X in the last hour T .

[0128] The historical operation behavior of the account ID is used to assign the operation type according to the user's operation habits to obtain a collection. <V D ,V S ,V U ,V i ,V d ,V A >.

[0129] Finally, calculate the operation time risk value:

[0130]

[0131] in, <V w ,V n ,V i >∈[0,1], T is the operation time, t w is the working time, t n is non-working time, t i No login time.

[0132] Calculate the operation frequency risk value:

[0133]

[0134] Among them, E(X) is the average historical operation frequency in each time period, X T The operating frequency

[0135] Calculate the risk value of the operation content:

[0136]

[0137] Among them, α is the weight corresponding to the operation time risk value, β is the weight corresponding to the operation frequency risk value, V (i,S,D,Y,d,A) The current operation type.

[0138] The operational risks are:

[0139] R sum =α*R T +β*R F +γ*R A

[0140] Among them, γ is the weight corresponding to the risk value of the operation content, and the sum of α, β and γ is 1.

[0141] Assume that the no-login time period t is obtained based on the user's historical data analysis i is 8:00, the historical average number of database queries in one hour is E(X) is 50, and the operation frequency in the last hour is X T is 60. Figure 3 The formula is R T Assign a value of 1. Calculate RF About 0.504134; set R T The weights α=0.2,β=0.3,γ=0.5, assuming that this operation is an update operation, this action V U is 0.8, and then R is calculated A is about 0.5619; finally, the risk value R of this operation database is obtained sum It is 0.6321.

[0142] S950: Query corresponding information.

[0143] S960. Return the queried information.

[0144] If the current operational risk is less than the preset risk value, the database queries the corresponding information and returns the queried information to the user.

[0145] The method provided by the present application has good versatility and security. It analyzes the characteristics of the user's daily operation behavior on the database, and uses a unique calculation algorithm to derive the risk of this operation behavior. The execution result is used to determine whether there is a risk in this query operation. At the same time, combined with the existing database security protection function, while ensuring the security of the query behavior, it ensures that the query is initiated by the operating user himself, reduces the risk of information leakage caused by account theft or non-user operation of the account, and is suitable for general web business operating systems.

[0146] The following describes an apparatus embodiment of the present application, which can be used to execute the access control method in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the access control method of the present application.

[0147] like Fig.10 As shown, Fig.10 : is a schematic diagram of the structure of an access control device shown in an exemplary embodiment of the present application. The device is deployed on a server and includes:

[0148] The acquisition module 1010 is used to acquire the operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes the operation time, operation frequency and operation content;

[0149] The analysis module 1020 is used to analyze the operation behavior data to calculate the operation time risk value, the operation frequency risk value and the operation content risk value;

[0150] A calculation module 1030, configured to calculate the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value;

[0151] The control module 1040 is used to control the access operation according to the operation risk.

[0152] In some embodiments of the present application, based on the aforementioned scheme, the analysis module 1020 is further used to calculate the operation time risk value according to the operation time; calculate the operation frequency risk value according to the operation frequency; calculate the operation content risk value according to the operation time risk value, the operation frequency risk value and the operation content.

[0153] In some embodiments of the present application, based on the aforementioned scheme, the analysis module 1020 is further used to obtain at least two time periods divided based on the historical operation frequency of the user's historical access operations, and the risk value corresponding to each time period; match the operation time with the at least two time periods to obtain the risk value corresponding to the matched time period; and obtain the operation time risk value according to the risk value corresponding to the matched time period.

[0154] In some embodiments of the present application, based on the aforementioned scheme, the operation frequency is the frequency within the most recent time period including the operation time, and the analysis module 1020 is further used to obtain the total number of operations of the user in the historical time period; divide the historical time period into multiple time periods to calculate the average historical operation frequency in each time period; calculate the operation frequency risk value based on the average historical operation frequency in each time period and the operation frequency.

[0155] In some embodiments of the present application, based on the aforementioned scheme, the analysis module 1020 is further used to obtain multiple operation types obtained by classifying the historical operation content of the user, and the risk value corresponding to each operation type; determine the target operation type corresponding to the operation content to obtain the risk value corresponding to the target operation type; calculate the operation content risk value according to the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type.

[0156] In some embodiments of the present application, based on the aforementioned scheme, the analysis module 1020 is further used to obtain the first weight and the second weight corresponding to the operation time risk value and the operation frequency risk value respectively; according to the first weight and the second weight, the operation time risk value and the operation frequency risk value are weighted to obtain a weighted risk value; and the operation content risk value is calculated according to the weighted risk value and the risk value corresponding to the target operation type.

[0157] In some embodiments of the present application, based on the aforementioned scheme, the calculation module 1030 is further used to obtain the first weight, second weight and third weight corresponding to the operation time risk value, the operation frequency risk value and the operation content risk value, respectively, wherein the value of the first weight is smaller than the value of the second weight, and the value of the second weight is smaller than the third weight value; the operation time risk value, the operation frequency risk value and the operation content risk value are weighted and summed according to the first weight, the second weight and the third weight to obtain the operation risk.

[0158] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here.

[0159] The device of the embodiment of the present application obtains the operation behavior data corresponding to the access operation of the user to which the client belongs, and then analyzes the operation behavior data to calculate the operation time risk value, the operation frequency risk value and the operation content risk value, and then combines the risk values ​​of the three dimensions to obtain the operation risk of the end user's access operation, thereby ensuring the accuracy of the operation risk determination, and controlling the access operation based on the operation risk, further reducing the probability of operations not performed by the user himself, and effectively increasing the security of access and the confidentiality of data information.

[0160] In an exemplary embodiment, an electronic device includes one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, enable the electronic device to implement the method described above. It is understood that the electronic device can be deployed in a server.

[0161] Fig.11 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment.

[0162] It should be noted that the electronic device is only an example adapted to the present application and cannot be considered to provide any limitation on the scope of use of the present application. The electronic device cannot be interpreted as requiring dependence on or having Fig.11 One or more components of an exemplary electronic device shown in FIG.

[0163] like Fig.11 As shown, in an exemplary embodiment, the electronic device includes a processing component 1101, a memory 1102, a power component 1103, a multimedia component 1104, an audio component 1105, a processor 1106, a sensor component 1107 and a communication component 1108. Among them, the above components are not all necessary, and the electronic device can add other components or reduce certain components according to its own functional requirements, which is not limited in this embodiment.

[0164] The processing component 1101 generally controls the overall operation of the electronic device, such as operations associated with display, data communication, and log data synchronization. The processing component 1101 may include one or more processors 1106 to execute instructions to complete all or part of the steps of the above operations. In addition, the processing component 1101 may include one or more modules to facilitate the interaction between the processing component 1101 and other components. For example, the processing component 1101 may include a multimedia module to facilitate the interaction between the multimedia component 1104 and the processing component 1101.

[0165] The memory 1102 is configured to store various types of data to support operations on the electronic device, examples of which include instructions for any application or method for operating on the electronic device. The memory 1102 stores one or more modules, which are configured to be executed by the one or more processors 1106 to complete all or part of the steps in the method described in the above embodiment.

[0166] The power supply component 1103 provides power to various components of the electronic device. The power supply component 1103 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device.

[0167] The multimedia component 1104 includes a screen that provides an output interface between the electronic device and the user. In some embodiments, the screen may include a TP (Touch Panel) and an LCD (Liquid Crystal Display). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0168] The audio component 1105 is configured to output and / or input audio signals. For example, the audio component 1105 includes a microphone, and when the electronic device is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. In some embodiments, the audio component 1105 also includes a speaker for outputting audio signals.

[0169] The sensor component 1107 includes one or more sensors for providing status evaluation of various aspects for the electronic device. For example, the sensor component 1107 can detect the on / off state of the electronic device and can also detect the temperature change of the electronic device.

[0170] The communication component 1108 is configured to facilitate wired or wireless communication between the electronic device and other devices. The electronic device can access a wireless network based on a communication standard, such as Wi-Fi (Wireless-Fidelity).

[0171] Understandably, Fig.11 The structure shown is for illustration only, and the electronic device may include Fig.11 More or fewer components as shown, or with Fig.11 The different components are shown. Fig.11 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0172] In an exemplary embodiment, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0173] It should be noted that the computer-readable storage medium shown in the embodiment of the present application can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0174] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0175] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. An access control method, characterized in that: The method comprises: Acquire operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes operation time, operation frequency and operation content; Calculating an operation time risk value according to the operation time; Calculating an operating frequency risk value according to the operating frequency; Acquire multiple operation types obtained by classifying the historical operation contents of the user, and configure the risk value corresponding to each operation type based on the operation habits of the user; Determine a target operation type corresponding to the operation content, and compare each operation type obtained according to the classification of the user's historical operation content with the target operation type to obtain a risk value corresponding to the target operation type; Calculate the operation content risk value according to the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type; Calculate the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value; The access operation is controlled according to the operation risk.

2. The method according to claim 1, characterized in that: The calculating the operation time risk value according to the operation time includes: Acquire at least two time periods divided based on the historical operation frequency of the historical access operations of the user, and a risk value corresponding to each time period; Matching the operation time with the at least two time periods to obtain a risk value corresponding to the matched time periods; The operation time risk value is obtained according to the risk value corresponding to the matched time period.

3. The method according to claim 1, characterized in that: The operation frequency is the frequency in the most recent time period including the operation time; and calculating the operation frequency risk value according to the operation frequency includes: Obtain the total number of operations of the user in the historical time period; Divide the historical time period into a plurality of the time periods to calculate an average historical operation frequency in each time period; The operation frequency risk value is calculated according to the average historical operation frequency in each time period and the operation frequency.

4. The method according to claim 1, characterized in that: The calculating the operation content risk value according to the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type includes: Obtain a first weight and a second weight corresponding to the operation time risk value and the operation frequency risk value respectively; According to the first weight and the second weight, weighting the operation time risk value and the operation frequency risk value is performed to obtain a weighted risk value; The operation content risk value is calculated according to the weighted risk value and the risk value corresponding to the target operation type.

5. The method according to claim 1, characterized in that The calculating the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value includes: Obtaining a first weight, a second weight, and a third weight corresponding to the operation time risk value, the operation frequency risk value, and the operation content risk value, respectively, wherein the value of the first weight is less than the value of the second weight, and the value of the second weight is less than the value of the third weight; The operation risk is obtained by performing weighted sum processing on the operation time risk value, the operation frequency risk value and the operation content risk value according to the first weight, the second weight and the third weight.

6. An access control device, characterized in that: The device comprises: An acquisition module, used to acquire operation behavior data corresponding to the access operation of the user to which the client belongs, wherein the operation behavior data includes operation time, operation frequency and operation content; an analysis module, configured to calculate an operation time risk value according to the operation time; calculate an operation frequency risk value according to the operation frequency; obtain a plurality of operation types obtained by classifying the historical operation content of the user, and configure a risk value corresponding to each operation type based on the operation habit of the user; determine a target operation type corresponding to the operation content, and compare each operation type obtained by classifying the historical operation content of the user with the target operation type to obtain a risk value corresponding to the target operation type; calculate an operation content risk value according to the operation time risk value, the operation frequency risk value and the risk value corresponding to the target operation type; a calculation module, configured to calculate the operation risk of the access operation according to the operation time risk value, the operation frequency risk value and the operation content risk value; A control module is used to control the access operation according to the operation risk.

7. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: Computer readable instructions are stored thereon, and when the computer readable instructions are executed by a processor of a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images