Enterprise network data security management method and system

Abstract

The present application relates to the technical field of enterprise network data security, and particularly relates to an enterprise network data security management method and system, wherein the method comprises: obtaining dynamic data of employees in an enterprise; constructing an information security library based on the dynamic data; determining whether to construct a security transfer station for external network access based on the information security library; when the security transfer station is constructed, the external network access accesses internal network data based on the security transfer station. The enterprise network data security management method of the present application triggers the construction of a security transfer station through an information security library constructed based on the dynamic data of employees, thereby isolating the direct threat of external network access to internal network data and improving the security of internal network data.

Description

Technical Field

[0001] This invention relates to the field of enterprise network data security technology, and in particular to an enterprise network data security management method and system. Background Technology

[0002] With the development of computer information technology, most enterprises have already achieved office automation and are gradually moving towards production automation; in this development process, enterprise information security is particularly important. Current enterprise network architecture typically involves setting up a local area network (LAN) within the enterprise and authorizing external network access through permission systems. However, when employees are unable to access internal data due to special reasons (such as business trips) and need to access internal network data from the external network, this creates an opportunity for security breaches. Ensuring enterprise information security when accessing internal network data from the external network is a pressing technical problem that needs to be solved. Summary of the Invention

[0003] One of the objectives of this invention is to provide an enterprise network data security management method. By constructing an information security database based on dynamic employee data, a secure relay station is triggered to isolate the direct threat of external network access to internal network data, thereby improving the security of internal network data.

[0004] An embodiment of the present invention provides an enterprise network data security management method, comprising:

[0005] Obtain dynamic data on employees within the enterprise;

[0006] Based on the aforementioned dynamic data, an information security database is constructed;

[0007] Based on the aforementioned information security database, determine whether to build a secure relay station for external network access;

[0008] When the secure relay station is constructed, external network access is based on the secure relay station to access internal network data.

[0009] Preferably, the step of constructing an information security database based on the dynamic data includes:

[0010] Analyze the dynamic data to determine whether the employee's movement category is a trigger type;

[0011] When it is a trigger type, determine the corresponding secure location and / or secure access device information;

[0012] The employee is designated as the triggering person in the information security database;

[0013] The secure location and / or secure access device information are used as trigger conditions.

[0014] Preferably, determining whether to build a secure relay station for external network access based on the information security database includes:

[0015] The external network access is analyzed to determine the identification information of the accessing personnel;

[0016] The identification information is matched with the triggering personnel in the information security database;

[0017] When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, the external network access is denied.

[0018] When the information security database contains a triggering person that matches the person corresponding to the identification information, the triggering judgment condition corresponding to the triggering person is extracted.

[0019] The external network access is parsed again to obtain the access location and / or access device information of the user;

[0020] A secure transit station is constructed when the access location does not match the secure location and / or the access device information does not match the secure device information.

[0021] Preferably, when the secure relay station is constructed, the external network access is based on the secure relay station to access internal network data, including:

[0022] Based on the external network access, determine the location information of the internal network data accessed by the external network access;

[0023] Based on the location information, the internal network data accessed by the external network is mirrored to the storage module in the secure relay station;

[0024] Receive data operations on the internal network data on the storage module from the user corresponding to the external network access;

[0025] The data operations include one or more combinations of: changing, deleting, and adding.

[0026] Preferred methods for enterprise network data security management also include:

[0027] When the external network access ends, determine the operation status of the internal network data mirrored on the storage module;

[0028] Based on the aforementioned operational conditions, a risk assessment vector is constructed;

[0029] Obtain the pre-defined risk assessment library;

[0030] Based on the risk assessment vector and the risk assessment library, the risk value of the safe transfer station is determined;

[0031] Based on the risk value, the processing mode of the safe transfer station is determined;

[0032] The construction of the risk assessment vector based on the operated situation includes:

[0033] Obtain the preset importance value of each piece of intranet data in the storage module and the preset weight coefficient of the position of the intranet data within the intranet;

[0034] The data operations on each intranet data are quantized based on a preset quantization template to obtain quantization coefficients;

[0035] Based on the importance value, weight coefficient, and quantification coefficient, the threat value of each intranet data is determined;

[0036] Extract a preset amount of intranet data from the storage module based on the threat value in descending order;

[0037] The extracted intranet data is arranged according to the extraction order, with the corresponding importance values, weight coefficients, and quantification coefficients arranged to generate the risk assessment vector.

[0038] Preferably, determining the processing mode of the secure transfer station based on the risk value includes:

[0039] When the risk value is lower than a preset first threshold, the security relay station is deleted when the external network access ends;

[0040] When the risk value is greater than or equal to the first threshold and less than the second threshold, it is submitted to the security administrator after the external network access ends, and deleted after confirmation by the security administrator;

[0041] When the risk value is greater than or equal to a preset second threshold, after the external network access ends, it is submitted to the security administrator. After the security administrator confirms it, when the accessing person corresponding to the external network access uses the internal network for the next time, a preset operation confirmation message is output; when the operation confirmation message is received, the security transfer station is deleted.

[0042] The present invention also provides an enterprise network data security management system, comprising:

[0043] The dynamic data acquisition module is used to acquire dynamic data of employees within the enterprise.

[0044] The first construction module is used to construct an information security database based on the dynamic data;

[0045] The second construction module is used to determine, based on the information security database, whether to build a secure relay station for external network access;

[0046] An indirect access module is used to allow external network access to internal network data based on the secure relay station when the secure relay station is constructed.

[0047] Preferably, the first construction module constructs an information security database based on the dynamic data and performs the following operations:

[0048] Analyze the dynamic data to determine whether the employee's movement category is a trigger type;

[0049] When it is a trigger type, determine the corresponding secure location and / or secure access device information;

[0050] The employee is designated as the triggering person in the information security database;

[0051] The secure location and / or secure access device information are used as trigger conditions.

[0052] Preferably, the second construction module, based on the information security database, determines whether to build a secure relay station for external network access and performs the following operations:

[0053] The external network access is analyzed to determine the identification information of the accessing personnel;

[0054] The identification information is matched with the triggering personnel in the information security database;

[0055] When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, the external network access is denied.

[0056] When the information security database contains a triggering person that matches the person corresponding to the identification information, the triggering judgment condition corresponding to the triggering person is extracted.

[0057] The external network access is parsed again to obtain the access location and / or access device information of the user;

[0058] A secure transit station is constructed when the access location does not match the secure location and / or the access device information does not match the secure device information.

[0059] Preferably, the indirect access module performs the following operations:

[0060] Based on the external network access, determine the location information of the internal network data accessed by the external network access;

[0061] Based on the location information, the internal network data accessed by the external network is mirrored to the storage module in the secure relay station;

[0062] Receive data operations on the internal network data on the storage module from the user corresponding to the external network access;

[0063] The data operations include one or more combinations of: changing, deleting, and adding.

[0064] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0065] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0066] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0067] Figure 1 This is a schematic diagram of an enterprise network data security management method according to an embodiment of the present invention;

[0068] Figure 2 This is a schematic diagram of an enterprise network data security management system according to an embodiment of the present invention. Detailed Implementation

[0069] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0070] This invention provides a method for enterprise network data security management, such as... Figure 1 As shown, it includes:

[0071] Step S1: Obtain dynamic data of employees within the enterprise;

[0072] Step S2: Construct an information security database based on dynamic data;

[0073] Step S3: Based on the information security database, determine whether to build a secure relay station for external network access;

[0074] Step S4: When a secure relay station is built, external network access is based on the secure relay station to access internal network data.

[0075] The working principle and beneficial effects of the above technical solution are as follows:

[0076] When external network access occurs, a security database built based on pre-constructed dynamic data analysis of employees is used to determine whether the access was initiated by a company employee and its security. If the environment is insecure, such as hardware or software defects or vulnerabilities in the external network (which could provide opportunities for cyber attackers), a secure relay station is established. Data from external network access is output through this secure relay station, isolating insecure external network access and thus isolating direct threats from external network access to internal network data, thereby improving the security of internal network data. Dynamic data can be identified through attendance records, business trip applications, leave applications, etc. If attendance records exist for a given day, the dynamic data is determined to be within the company; if leave application records exist, the dynamic data indicates a leave application; and if business trip application records exist, the dynamic data indicates a business trip.

[0077] In one embodiment, an information security database is constructed based on dynamic data, including:

[0078] Analyze dynamic data to determine whether an employee's activity category is a trigger type;

[0079] When it is a trigger type, determine the corresponding secure location and / or secure access device information;

[0080] Employees are included as triggers in the information security database;

[0081] Secure location and / or secure access device information are used as triggering conditions.

[0082] The working principle and beneficial effects of the above technical solution are as follows:

[0083] By analyzing whether an employee's dynamic data constitutes a trigger type, the system can identify the triggering personnel in the information security database and determine the secure location and / or secure access device information based on the triggering personnel. This information is then used as the trigger determination condition. Specifically, when the trigger type is set to include "business trip," the secure location during the business trip is set to the destination of the business trip application. When the trigger type is set to include "leave," the corresponding secure location is the employee's home address (i.e., the registered actual home address) or household registration location associated with the employee. Furthermore, the secure access device information is determined based on the device information associated with the employee's information. Device information includes: machine serial number, etc.

[0084] In one embodiment, determining whether to build a secure relay station for external network access, based on an information security database, includes:

[0085] Analyze external network access to identify the user.

[0086] Match the identification information with the triggering personnel in the information security database;

[0087] When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, external network access is denied.

[0088] When a triggering person is found in the information security database that matches the person identified by the identification information, the triggering conditions corresponding to the triggering person are extracted.

[0089] Re-analyze external network access to obtain the access location and / or access device information of the user;

[0090] A secure relay station is constructed when the access location does not match the secure location and / or the access device information does not match the secure device information.

[0091] The working principle and beneficial effects of the above technical solution are as follows:

[0092] By parsing external network access, the system identifies the user's information; based on this information, it determines whether the user is the triggering party; if the user is not the triggering party, the external network access request is rejected; if the user is identified as the triggering party, the system again assesses access risk based on security location and device information. If the access location does not match the security location and / or the access device information does not match the security device information, a risk is identified, and a security relay station is built to isolate the risk; if both match, no risk is identified, and internal network data access can be performed directly.

[0093] To enable external network access to internal network data under risky conditions; in one embodiment, when a secure relay station is constructed, external network access to internal network data is based on the secure relay station, including:

[0094] Based on external network access, determine the location information of internal network data accessed by external network access;

[0095] Based on location information, internal network data accessed from the external network is mirrored to the storage module in the secure relay station;

[0096] Receive data operations on the internal network data on the storage module from users accessing the external network.

[0097] Data operations include one or more of the following: modification, deletion, and addition.

[0098] The working principle and beneficial effects of the above technical solution are as follows:

[0099] By mirroring intranet data to a secure relay station, external network access directly accesses the data within the secure relay station, isolating risks and improving the security of intranet data.

[0100] In one embodiment, an enterprise network data security management method, such as Figure 2 As shown, it also includes:

[0101] Step S5: After the external network access ends, determine the operation status of the internal network data mirrored on the storage module;

[0102] Step S6: Construct a risk assessment vector based on the operational situation;

[0103] Step S7: Obtain the preset risk assessment library;

[0104] Step S8: Determine the risk value of the safe transit station based on the risk assessment vector and the risk assessment library;

[0105] Step S9: Determine the processing mode for the safe transfer station based on the risk value;

[0106] Among them, a risk assessment vector is constructed based on the operational situation, including:

[0107] The system retrieves the preset importance values ​​of each piece of intranet data in the storage module and the preset weight coefficients of the intranet data's location within the intranet. Both the importance values ​​and weight coefficients are pre-configured by the system administrator. The importance values ​​are configured based on the importance of the intranet data; the more important the data, the higher its importance value. The weight coefficients are configured for each intranet storage area, and the location of the intranet data within the intranet is the intranet storage area of ​​the mirror object within the intranet.

[0108] Based on a preset quantization template, the data operations performed on each intranet data are quantified to obtain quantization coefficients. For example: if no operation is performed but the data is viewed, the quantization coefficient is 0; if an operation is performed, the quantization coefficient is 0.5; if an operation is performed, the quantization coefficient is 1; if an operation is performed, the quantization coefficient is 2.

[0109] The threat value of each piece of intranet data is determined based on the importance value, weight coefficient, and quantification coefficient; the product of the importance value, weight coefficient, and quantification coefficient is used as the numerical value of the threat value.

[0110] Extract a preset number (e.g., 3) of intranet data from storage modules based on the threat value from highest to lowest.

[0111] The extracted intranet data is arranged according to the extraction order, with the corresponding importance values, weight coefficients, and quantification coefficients arranged to generate a risk assessment vector.

[0112] Among these, the handling mode for the safe transfer station is determined based on the risk value, including:

[0113] When the risk value is lower than a preset first threshold (e.g., any value between 0 and 10), the security relay station is deleted when external network access ends.

[0114] When the risk value is greater than or equal to the first threshold and less than the second threshold (e.g., any value between 80 and 90), it is submitted to the security administrator after the external network access ends, and deleted after the security administrator confirms it.

[0115] When the risk value is greater than or equal to the preset second threshold, after the external network access ends, it is submitted to the security administrator. After the security administrator confirms it, when the corresponding user accesses the external network again using the internal network, the preset operation confirmation information will be output. When the operation confirmation information is received, the security transfer station will be deleted.

[0116] The working principle and beneficial effects of the above technical solution are as follows:

[0117] After external network access ends, a risk assessment is performed to determine the risk value of the secure relay station. This determines the processing method for data in the secure relay station after the event. If the risk is low, the secure relay station is directly deleted, and the operations within it are mirrored to the internal network. If the risk is medium (risk value greater than or equal to the first threshold and less than the second threshold), synchronization to the internal network requires confirmation from the security administrator. If the risk is high, confirmation from both the security administrator and external network users accessing the internal network is required. This assessment and confirmation process ensures the security and effectiveness of data operations during external network access. If confirmation is required before deleting the secure relay station, synchronization to the internal network is only possible after confirmation; otherwise, the secure relay station is simply deleted. The risk value of the secure relay station is determined based on risk assessment vectors and a risk assessment library. This can be achieved by calculating the similarity between the risk assessment vector and each standard vector in the risk assessment library. When the similarity exceeds a preset similarity threshold, the corresponding risk value associated with the standard vector is extracted. Cosine similarity can be used to calculate the similarity. The risk assessment library is constructed by professionals based on extensive data analysis.

[0118] The present invention also provides an enterprise network data security management system, comprising:

[0119] Dynamic data acquisition module 1 is used to acquire dynamic data of employees within the enterprise;

[0120] The first construction module 2 is used to build an information security database based on dynamic data;

[0121] The second construction module 3 is used to determine whether to build a secure relay station for external network access based on the information security database;

[0122] Indirect access module 4 is used to allow external network access to internal network data when a secure relay station is built.

[0123] In one embodiment, the first construction module 2 constructs an information security database based on dynamic data and performs the following operations:

[0124] Analyze dynamic data to determine whether an employee's activity category is a trigger type;

[0125] When it is a trigger type, determine the corresponding secure location and / or secure access device information;

[0126] Employees are included as triggers in the information security database;

[0127] Secure location and / or secure access device information are used as triggering conditions.

[0128] In one embodiment, the second construction module 3, based on an information security database, determines whether to build a secure relay station for external network access and performs the following operations:

[0129] Analyze external network access to identify the user.

[0130] Match the identification information with the triggering personnel in the information security database;

[0131] When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, external network access is denied.

[0132] When a triggering person is found in the information security database that matches the person identified by the identification information, the triggering conditions corresponding to the triggering person are extracted.

[0133] Re-analyze external network access to obtain the access location and / or access device information of the user;

[0134] A secure relay station is constructed when the access location does not match the secure location and / or the access device information does not match the secure device information.

[0135] In one embodiment, the indirect access module 4 performs the following operations:

[0136] Based on external network access, determine the location information of internal network data accessed by external network access;

[0137] Based on location information, internal network data accessed from the external network is mirrored to the storage module in the secure relay station;

[0138] Receive data operations on the internal network data on the storage module from users accessing the external network.

[0139] Data operations include one or more of the following: modification, deletion, and addition.

[0140] In one embodiment, the enterprise network data security management system further includes: a processing module;

[0141] The processing module performs the following operations:

[0142] When external network access ends, determine the status of the internal network data mirrored on the storage module that has been manipulated;

[0143] Based on the operational situation, a risk assessment vector is constructed;

[0144] Obtain the pre-defined risk assessment library;

[0145] Based on risk assessment vectors and risk assessment library, the risk value of the safe transfer station is determined;

[0146] Based on the risk value, determine the processing mode for the safe transfer station;

[0147] Among them, a risk assessment vector is constructed based on the operational situation, including:

[0148] Obtain the preset importance value of each piece of intranet data in the storage module and the preset weight coefficient of the intranet data's position within the intranet;

[0149] The data operations on each intranet data are quantized based on a preset quantization template to obtain quantization coefficients;

[0150] The threat value of each piece of intranet data is determined based on importance value, weight coefficient, and quantification coefficient.

[0151] Extract a preset number of intranet data from storage modules based on threat values ​​from highest to lowest.

[0152] The extracted intranet data is arranged according to the extraction order, with the corresponding importance values, weight coefficients, and quantification coefficients arranged to generate a risk assessment vector.

[0153] In one embodiment, the processing module determines the processing mode of the secure transfer station based on the risk value and performs the following operations:

[0154] When the risk value is lower than the preset first threshold, the security relay station is deleted when external network access ends;

[0155] When the risk value is greater than or equal to the first threshold and less than the second threshold, it is submitted to the security administrator after the external network access ends, and deleted after the security administrator confirms it.

[0156] When the risk value is greater than or equal to the preset second threshold, after the external network access ends, it is submitted to the security administrator. After the security administrator confirms it, when the corresponding user accesses the external network again using the internal network, the preset operation confirmation information will be output. When the operation confirmation information is received, the security transfer station will be deleted.

[0157] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for enterprise network data security management, characterized in that, include: Acquire dynamic data of employees within the enterprise, including attendance record data, business trip application data, and leave application data; Based on the aforementioned dynamic data, an information security database is constructed; Based on the aforementioned information security database, determine whether to build a secure relay station for external network access; When the secure relay station is constructed, external network access is based on the secure relay station to access internal network data; The construction of the information security database based on the dynamic data includes: Analyze the dynamic data to determine whether the employee's movement category is a trigger type; When it is a trigger type, determine the corresponding secure location and / or secure access device information; The employee is designated as the triggering person in the information security database; The secure location and / or secure access device information are used as trigger conditions, wherein when the trigger type is set to include: during a business trip, the secure location during the business trip is set to the destination of the business trip application; when... The trigger type is set to include: when taking leave, the corresponding safe location is the home address or household registration location associated with the employee's information in the company; The step of determining whether to build a secure relay station for external network access based on the information security database includes: The external network access is analyzed to determine the identification information of the accessing personnel; The identification information is matched with the triggering personnel in the information security database; When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, the external network access is denied. When the information security database contains a triggering person that matches the person corresponding to the identification information, the triggering judgment condition corresponding to the triggering person is extracted. The external network access is parsed again to obtain the access location and / or access device information of the user; A secure transit station is constructed when the access location does not match the secure location and / or the access device information does not match the secure access device information.

2. The enterprise network data security management method as described in claim 1, characterized in that, When the secure relay station is constructed, external network access is based on the secure relay station to access internal network data, including: Based on the external network access, determine the location information of the internal network data accessed by the external network access; Based on the location information, the internal network data accessed by the external network is mirrored to the storage module in the secure relay station; Receive data operations on the internal network data on the storage module from the user corresponding to the external network access; The data operations include one or more combinations of: changing, deleting, and adding.

3. The enterprise network data security management method as described in claim 2, characterized in that, Also includes: When the external network access ends, determine the operation status of the internal network data mirrored on the storage module; Based on the aforementioned operational conditions, a risk assessment vector is constructed; Obtain the pre-defined risk assessment library; Based on the risk assessment vector and the risk assessment library, the risk value of the safe transfer station is determined; Based on the risk value, the processing mode of the safe transfer station is determined; The construction of the risk assessment vector based on the operated situation includes: Obtain the preset importance value of each piece of intranet data in the storage module and the preset weight coefficient of the position of the intranet data within the intranet; The data operations on each intranet data are quantized based on a preset quantization template to obtain quantization coefficients; Based on the importance value, weight coefficient, and quantification coefficient, the threat value of each intranet data is determined; Extract a preset amount of intranet data from the storage module based on the threat value in descending order; The extracted intranet data is arranged according to the extraction order, with the corresponding importance values, weight coefficients, and quantification coefficients arranged to generate the risk assessment vector.

4. The enterprise network data security management method as described in claim 3, characterized in that, The process of determining the handling mode of the secure transfer station based on the risk value includes: When the risk value is lower than a preset first threshold, the security relay station is deleted when the external network access ends; When the risk value is greater than or equal to the first threshold and less than the preset second threshold, it is submitted to the security administrator after the external network access ends, and deleted after confirmation by the security administrator; When the risk value is greater than or equal to the second threshold, after the external network access ends, it is submitted to the security administrator. After the security administrator confirms it, when the accessing personnel corresponding to the external network access use the internal network for the next time, a preset operation confirmation message is output; when the operation confirmation message is received, the security transfer station is deleted.

5. An enterprise network data security management system, characterized in that, include: The dynamic data acquisition module is used to acquire dynamic data of employees within the enterprise, including attendance record data, business trip application data, and leave application data. The first construction module, used to construct an information security database based on the dynamic data, includes: Analyze the dynamic data to determine whether the employee's movement category is a trigger type; When it is a trigger type, determine the corresponding secure location and / or secure access device information; The employee is designated as the triggering person in the information security database; The secure location and / or secure access device information are used as trigger conditions, wherein when the trigger type is set to include: during a business trip, the secure location during the business trip is set to the destination of the business trip application; when... The trigger type is set to include: when taking leave, the corresponding safe location is the home address or household registration location associated with the employee's information in the company; The second construction module, based on the information security database, determines whether to construct a secure relay station for external network access, including: The external network access is analyzed to determine the identification information of the accessing personnel; The identification information is matched with the triggering personnel in the information security database; When none of the triggering personnel in the information security database match the personnel corresponding to the identification information, the external network access is denied. When the information security database contains a triggering person that matches the person corresponding to the identification information, the triggering judgment condition corresponding to the triggering person is extracted. The external network access is parsed again to obtain the access location and / or access device information of the user; When the access location does not match the secure location and / or the access device information does not match the secure access device information, a secure transit station is constructed. An indirect access module is used to allow external network access to internal network data based on the secure relay station when the secure relay station is constructed.

6. The enterprise network data security management system as described in claim 5, characterized in that, The indirect access module performs the following operations: Based on the external network access, determine the location information of the internal network data accessed by the external network access; Based on the location information, the internal network data accessed by the external network is mirrored to the storage module in the secure relay station; Receive data operations on the internal network data on the storage module from the user corresponding to the external network access; The data operations include one or more combinations of: changing, deleting, and adding.

Images