Data access method, device, electronic device and readable medium

Abstract

The embodiment of the present invention provides a data access method, device, electronic device and readable medium, the method comprising: after the user logs in, the data access system receives a data access request sent by the user, determines whether the user has access rights to the data to be accessed, and when the user has access rights to the data to be accessed, determines whether there is sensitive data in the data to be accessed, and if there is sensitive data in the data to be accessed, performs protection processing on the sensitive data in the data to be accessed to obtain second target data; if there is no sensitive data in the data to be accessed or if the second target data contains non-sensitive data, determines the abnormality of the user's behavior, and performs protection processing on the second target data according to the abnormality of the user's behavior to obtain the first target data; and feeds back the first target data to the user. The method of the present invention not only ensures the security of sensitive data, but also avoids abnormal leakage of non-sensitive data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data access method, a data access device, an electronic device and a computer-readable medium. Background Art

[0002] DLP (Data Leakage Prevention Technology) is a strategy and technology that uses certain technical means to prevent the designated data or information assets of an enterprise from flowing out of the enterprise in a form that violates the provisions of security policies. DLP technology can process the data storage, use and transmission process, identify and process the data content, ensure that the data can be processed transparently, intelligently encrypted, with high stability and system compatibility, and can form a detailed audit log at the data content level. The core technical points of DLP include transmission protocol analysis, data format content identification, high-speed rule matching, natural semantic analysis, machine learning, clustering analysis, data feature matching, etc.

[0003] At present, DLP generally adopts three basic detection technologies and three advanced detection technologies. There are usually three methods in basic detection technology: regular expression detection, keyword and keyword pair detection, and document attribute detection. The basic detection method uses conventional detection technology to search and match content. Regular expressions and keywords are more common. These two methods can detect explicit sensitive information content. Document attribute detection mainly detects the type, size, and name of the document. The detection of the document type is based on the file format, not simply based on the suffix name. For the scenario of modifying the suffix name, file type detection can accurately detect the type of the detected file, and can identify documents of special file type formats through custom features. There are also three methods in advanced detection technology: exact data matching (EDM), fingerprint document matching (IDM), and vector classification matching (SVM). EDM is used to protect data that is usually in a structured format, such as customer or employee database records. IDM and SVM are used to protect unstructured data, such as Word documents. For EDM, IDM, and SVM, sensitive data is first identified by the enterprise, and then characterized by DLP for accurate and continuous detection. The process of characterization includes DLP accessing and retrieving text and data, normalizing it, and protecting it using irreversible scrambling methods.

[0004] At present, DLP, whether it is the three basic detection technologies or the three advanced detection technologies, is based on the document itself or the data itself, and does not make any judgments on the access behavior. In other words, the conclusion drawn by DLP at present is only that the data is sensitive or insensitive. For insensitive data, the original data will be displayed to the visitor regardless of whether the visitor's behavior is normal or abnormal.

[0005] However, if the visitor's behavior is abnormal, it means that the visitor is an abnormal user. If you still provide him with original data, although it does not contain sensitive data, there will be a risk of data leakage. Summary of the invention

[0006] In view of the above problems, embodiments of the present invention are proposed to provide a data access method, a data access device, an electronic device and a computer-readable medium that overcome the above problems or at least partially solve the above problems.

[0007] The embodiment of the present invention discloses a data access method, which is applied to a data access system, wherein the data access system records data accessed by a user each time, including:

[0008] After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the data to be accessed corresponding to the data access request;

[0009] If the user has access rights to the data to be accessed, determining whether there is sensitive data in the data to be accessed;

[0010] If there is no sensitive data in the data to be accessed, determining the abnormality of the user's behavior;

[0011] According to the abnormality of the user's behavior, protection processing is performed on the data to be accessed to obtain first target data; the protection processing includes encryption and desensitization;

[0012] If there is sensitive data in the data to be accessed, protection processing is performed on the sensitive data in the data to be accessed to obtain second target data;

[0013] Determining whether the second target data includes non-sensitive data;

[0014] If the second target data includes non-sensitive data, determining the abnormality of the user's behavior;

[0015] According to the abnormality degree of the user's behavior, protection processing is performed on the second target data to obtain the first target data;

[0016] The first target data is fed back to the user.

[0017] Optionally, the data access request includes the permission level of the user, and the data to be accessed is set with an access level;

[0018] After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request, includes:

[0019] Determining whether the user is allowed to access the data to be accessed according to the authority level of the user and the access level of the data to be accessed;

[0020] When the authority level of the user is lower than the access level, determining that the user does not have access authority to the data to be accessed;

[0021] When the authority level of the user is greater than or equal to the access level, it is determined that the user has access authority to the data to be accessed.

[0022] Optionally, if there is no sensitive data in the data to be accessed, determining the abnormality of the user's behavior includes:

[0023] If there is no sensitive data in the data to be accessed, obtaining an access data set of the user;

[0024] The abnormality degree of the user's behavior is determined according to the access data set.

[0025] Optionally, if there is no sensitive data in the data to be accessed, obtaining the access data set of the user includes:

[0026] If there is no sensitive data in the data to be accessed, all data accessed by the user after logging in this time and before the current access are obtained to obtain the access data set of the user;

[0027] If the data accessed by the user after the current login and before the current visit is not obtained, then all the data accessed during the historical logins within a preset time period are obtained to obtain the access data set of the user.

[0028] Optionally, determining the abnormality of the user's behavior according to the access data set includes:

[0029] If the access data set is an empty set, determining that the user's behavior abnormality is a preset minimum value;

[0030] If the access data set is not empty, the device value and access value of each access data in the access data set are calculated respectively; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users;

[0031] The abnormality degree of the user's behavior is determined according to the device value and the access value of each access data.

[0032] Optionally, according to the abnormality of the user's behavior, performing protection processing on the data to be accessed to obtain the first target data includes:

[0033] Query at least one historical user who has accessed the data to be accessed;

[0034] Obtain all data accessed by each of the historical users after logging in and before accessing the data to be accessed, and obtain access data sets of each of the historical users respectively;

[0035] Using the access data set of each of the historical users, respectively calculating the behavior abnormality of each of the historical users;

[0036] The behavior abnormality of the historical users is used to calculate the average behavior abnormality of the historical users;

[0037] Determine whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold;

[0038] If so, it is determined that the user behavior is abnormal, and protection processing is performed on the data to be accessed to obtain the first target data.

[0039] Optionally, the method further comprises:

[0040] If the second target data does not include the non-sensitive data, the second target data is fed back to the user.

[0041] The embodiment of the present invention discloses a data access device, which is applied to a data access system. The data access system records data accessed by a user each time, including:

[0042] A receiving module, used to receive a data access request sent by a user after the user logs in, and determine whether the user has access rights to the data to be accessed corresponding to the data access request;

[0043] A sensitive data determination module, configured to determine whether there is sensitive data in the data to be accessed if the user has access rights to the data to be accessed;

[0044] A first behavior abnormality determination module, configured to determine the user's behavior abnormality if no sensitive data exists in the data to be accessed;

[0045] A to-be-accessed data processing module, used to perform protection processing on the to-be-accessed data according to the abnormality of the user's behavior to obtain first target data; the protection processing includes encryption and desensitization;

[0046] A sensitive data processing module, configured to, if there is sensitive data in the data to be accessed, perform protection processing on the sensitive data in the data to be accessed to obtain second target data;

[0047] a non-sensitive data determination module, configured to determine whether the second target data contains non-sensitive data;

[0048] a second behavior abnormality determination module, configured to determine the user's behavior abnormality if the second target data includes non-sensitive data;

[0049] A second target data processing module, configured to perform protection processing on the second target data according to the abnormality degree of the user's behavior to obtain first target data;

[0050] A feedback module is used to feed back the first target data to the user.

[0051] Optionally, the data access request includes the permission level of the user, and the data to be accessed is set with an access level;

[0052] The receiving module comprises:

[0053] An access permission judgment submodule, used to judge whether the user is allowed to access the data to be accessed according to the permission level of the user and the access level of the data to be accessed;

[0054] A first determination submodule, configured to determine that the user does not have access rights to the data to be accessed when the user's authority level is lower than the access level;

[0055] The second determining submodule is configured to determine that the user has access rights to the data to be accessed when the user's authority level is greater than or equal to the access level.

[0056] Optionally, the first behavior abnormality determination module includes:

[0057] An access data set acquisition submodule, used for acquiring the access data set of the user if no sensitive data exists in the data to be accessed;

[0058] The behavior abnormality determination submodule is used to determine the user's behavior abnormality based on the access data set.

[0059] Optionally, the accessing data set acquisition submodule includes:

[0060] A first access data set acquisition unit is used to acquire all data accessed by the user after the current login and before the current access, if there is no sensitive data in the data to be accessed, to obtain the access data set of the user;

[0061] The second access data set acquisition unit is used to acquire all data accessed during historical logins within a preset time period to obtain the access data set of the user if the data accessed by the user before the current visit after the current login is not acquired.

[0062] Optionally, the behavior abnormality determination submodule includes:

[0063] A first behavior abnormality determination unit, configured to determine that the user's behavior abnormality is a preset minimum value if the access data set is an empty set;

[0064] a device value and access value determination unit, configured to respectively calculate the device value and access value of each access data in the access data set if the access data set is not empty; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users;

[0065] The second behavior abnormality determination unit is used to determine the user's behavior abnormality according to the device value and the access value of each access data.

[0066] Optionally, the to-be-accessed data processing module includes:

[0067] A query submodule, used for querying at least one historical user who has accessed the data to be accessed;

[0068] A historical user access data set acquisition submodule is used to acquire all data accessed by each historical user after logging in and before accessing the data to be accessed, and obtain access data sets of each historical user respectively;

[0069] A historical user behavior abnormality determination submodule is used to use the access data set of each historical user to calculate the behavior abnormality of each historical user;

[0070] An average behavior abnormality determination submodule is used to calculate the average behavior abnormality of the historical users by using the behavior abnormality of the historical users;

[0071] A judgment submodule, used to judge whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold;

[0072] The to-be-accessed data processing submodule is used to determine that the user behavior is abnormal, perform protection processing on the to-be-accessed data, and obtain the first target data.

[0073] Optionally, the device further comprises:

[0074] A sending module is used to feed back the second target data to the user if the second target data does not include the non-sensitive data.

[0075] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0076] The memory is used to store computer programs;

[0077] The processor is used to implement the data access method described in the embodiment of the present invention when executing the program stored in the memory.

[0078] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored, and when executed by one or more processors, the processors execute the data access method as described in the embodiment of the present invention.

[0079] The embodiments of the present invention include the following advantages:

[0080] In an embodiment of the present invention, after a user logs in, the data access system receives a data access request sent by the user, determines whether the user has access rights to the data to be accessed corresponding to the data access request, and if the user has access rights to the data to be accessed, determines whether there is sensitive data in the data to be accessed, and if there is no sensitive data in the data to be accessed, determines the user's behavior abnormality, and performs protection processing on the data to be accessed according to the user's behavior abnormality to obtain the first target data; if there is sensitive data in the data to be accessed, performs protection processing on the sensitive data in the data to be accessed to obtain the second target data, and then determines whether the second target data contains non-sensitive data. If the second target data contains non-sensitive data, determines the user's behavior abnormality, and performs protection processing on the second target data according to the user's behavior abnormality to obtain the first target data; and feeds the first target data back to the user. In the method of the present invention, when the user has access rights, the sensitive data in the data accessed by the user is protected, and further protects the non-sensitive data according to the user's behavior abnormality, so that it can dynamically determine whether to provide data and what data to provide based on the user's access behavior, which not only ensures the security of sensitive data, but also avoids abnormal leakage of non-sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 is a step flow chart of a data access method provided in an embodiment of the present invention;

[0082] Figure 2 is a flowchart of another data access method provided in an embodiment of the present invention;

[0083] Figure 3 is a flow chart of controlling data access provided in an embodiment of the present invention;

[0084] Figure 4 is a structural block diagram of a data access device provided in an embodiment of the present invention;

[0085] Figure 5 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0086] Figure 6 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0087] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0088] Reference Figure 1, shows a flow chart of the steps of a data access method provided in an embodiment of the present invention, which may specifically include the following steps:

[0089] Step 101, after the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request;

[0090] In the prior art, data protection is usually carried out by processing sensitive data or sensitive data to protect sensitive data, while ignoring the protection of non-sensitive data. When the user behavior is abnormal, the user is an abnormal user. At this time, providing non-sensitive data to the user will also cause the risk of data leakage. Therefore, the present invention proposes a method for protecting non-sensitive data.

[0091] In an embodiment of the present invention, a data access system is provided. The data access system can record the data accessed by the user each time after the user logs in. For example, the data accessed by the user can be a document. If the user accesses D:\network\log\A.doc, then the document A.doc will be recorded. Under this recording mechanism, each time the user accesses data, the data access system can execute the data access method of the present invention to protect non-sensitive data.

[0092] After the user logs in, the data access system can receive the data access request sent by the user. The data access system can determine the data that the user wants to access based on the data information contained in the data access request, and further determine whether the user has the access rights to the data to be accessed corresponding to the data access request. If the user has the access rights to the data to be accessed, the next step of the data access process can be entered; if the user does not have the access rights to the data to be accessed, feedback information indicating that the user has no access rights can be returned to the user, and the data access process ends.

[0093] Step 102: If the user has access rights to the data to be accessed, determine whether there is sensitive data in the data to be accessed;

[0094] In order to protect sensitive data in the data to be accessed, after determining that the user has access rights to the data to be accessed, it is possible to further determine whether there is sensitive data in the data to be accessed. If there is sensitive data in the data to be accessed, the sensitive data can be processed in some way so that the sensitive data cannot be directly viewed by the user, thereby achieving protection of the sensitive data.

[0095] Specifically, some keywords may be preset, and the data access system may determine whether the data to be accessed contains sensitive data by identifying whether the preset keywords are contained in the data to be accessed.

[0096] Step 103, if there is no sensitive data in the data to be accessed, determining the abnormality of the user's behavior;

[0097] If the data access system determines that there is no sensitive data in the data to be accessed, that is, the data to be accessed are all non-sensitive data, then in order to protect the non-sensitive data, the user behavior dynamics can be further judged to determine whether the user is an abnormal user. When the user behavior dynamics are normal, the non-sensitive data can be provided to the user; when the user behavior dynamics are abnormal, the data to be accessed can be stopped from being provided to the user or some processing can be done on the data to be accessed before providing it to the user, so as to avoid the leakage of non-sensitive data.

[0098] In the embodiment of the present invention, a behavior abnormality degree can be used to indicate the user behavior dynamics. When the user's behavior abnormality degree is high, it can be explained that the user's behavior is abnormal, and when the user's behavior abnormality degree is low, it can be explained that the user's behavior is normal. Specifically, when it is determined that there is no sensitive data in the data to be accessed, the data access system can first calculate the user's behavior abnormality degree.

[0099] Step 104, performing protection processing on the data to be accessed according to the abnormality of the user's behavior to obtain first target data; the protection processing includes encryption and desensitization;

[0100] After determining the abnormality of the user's behavior, if the abnormality of the user's behavior is high, it can be determined that the user's behavior is abnormal. At this time, protection processing can be performed on the access data to obtain first target data, which is the processed access data and can be provided to the user. The protection processing may include encryption and desensitization, which is not limited in the present invention.

[0101] Specifically, some protection rules for non-sensitive data may be preset, and the data access system may perform protection processing on the accessed data according to the non-sensitive data protection rules.

[0102] Step 105: If there is sensitive data in the data to be accessed, protection processing is performed on the sensitive data in the data to be accessed to obtain second target data;

[0103] If the data access system determines that there is sensitive data in the data to be accessed, that is, the data to be accessed contains sensitive data, then in order to protect the sensitive data, protection processing can be performed on the sensitive data to obtain second target data, and then the second target data can be provided to the user to avoid leakage of sensitive data.

[0104] For example, if a mobile phone number is recognized, the mobile phone number can be desensitized; if an ID card number is recognized, the ID card number can be desensitized; if a license plate number is recognized, the license plate number can be desensitized.

[0105] Step 106, determining whether the second target data contains non-sensitive data;

[0106] After protecting the sensitive data in the accessed data and obtaining the second target data, since the second target data may also contain non-sensitive data, in order to protect the non-sensitive data, the data access system can also determine whether the second target data contains non-sensitive data to determine whether the non-sensitive data needs to be further processed.

[0107] Step 107, if the second target data includes non-sensitive data, determining the abnormality of the user's behavior;

[0108] When it is determined that the second target data contains non-sensitive data, in order to protect the non-sensitive data, the user behavior dynamics can be further determined to determine whether the user is an abnormal user. Specifically, the data access system can calculate the user's behavior abnormality and determine whether the user's behavior is normal based on the user's behavior abnormality.

[0109] Step 108, performing protection processing on the second target data according to the abnormality degree of the user's behavior to obtain the first target data;

[0110] After determining the abnormality of the user's behavior, if the abnormality of the user's behavior is high, it can be determined that the user's behavior is abnormal. At this time, protection processing can be performed on the second target data to obtain the first target data. The first target data is the processed data to be accessed and can be provided to the user.

[0111] Step 109: Feedback the first target data to the user.

[0112] In the case where the data to be accessed does not contain sensitive data, the first target data is data that is protected as non-sensitive data; in the case where the data to be accessed contains sensitive data, the first target data is data that is protected as sensitive data and non-sensitive data. Therefore, the first target data can be provided to the user, and the method is used to control data access, which not only ensures the security of sensitive data, but also avoids abnormal leakage of non-sensitive data.

[0113] Through the data access method of the embodiment of the present invention, after the user logs in, the data access system receives the data access request sent by the user, determines whether the user has the access right to the data to be accessed corresponding to the data access request, and if the user has the access right to the data to be accessed, determines whether there is sensitive data in the data to be accessed, and if there is no sensitive data in the data to be accessed, determines the abnormality of the user's behavior, and performs protection processing on the data to be accessed according to the abnormality of the user's behavior to obtain the first target data; if there is sensitive data in the data to be accessed, performs protection processing on the sensitive data in the data to be accessed to obtain the second target data, and then determines whether the second target data contains non-sensitive data. If the second target data contains non-sensitive data, determines the abnormality of the user's behavior, and performs protection processing on the second target data according to the abnormality of the user's behavior to obtain the first target data; and feeds the first target data back to the user. In the case where the user has the access right, the method of the present invention performs protection processing on the sensitive data in the data accessed by the user, and further performs protection processing on the non-sensitive data according to the abnormality of the user's behavior, so that it can dynamically determine whether to provide data and what data to provide based on the user's access behavior, which not only ensures the security of sensitive data, but also avoids the abnormal leakage of non-sensitive data.

[0114] Reference Figure 2 , shows a flowchart of another data access method provided in an embodiment of the present invention, which may specifically include the following steps:

[0115] Step 201, after the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request;

[0116] In an embodiment of the present invention, after the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request, includes:

[0117] S11, judging whether the user is allowed to access the data to be accessed according to the authority level of the user and the access level of the data to be accessed;

[0118] In the embodiment of the present invention, when a user registers, an access right is configured for him / her, and the access right is determined based on the user's position, level, etc., such as high, medium, and low. Or any number from 1 to 10, the higher the number, the higher the access right. Or other permission classification schemes, which are not limited by the present invention.

[0119] Data also has access levels. The data access level is set by the data owner when the data is stored. It is used to indicate what level of users can access the data. The data access level is matched with the user authority level. For example, if the user authority level is high, medium or low, the data access level is also high, medium or low.

[0120] After receiving a data access request, the data access system can first determine the user's authority level based on the user authority level contained in the data access request, and then determine the access level of the data to be accessed corresponding to the data access request, and then determine whether the user is allowed to access the data to be accessed based on the user's authority level and the access level of the data to be accessed.

[0121] S12, when the authority level of the user is lower than the access level, determining that the user does not have access rights to the data to be accessed;

[0122] If the user's authority level is lower than the access level of the data to be accessed, the user does not have the authority to access the data to be accessed. Therefore, when the data access system determines that the user's authority level is lower than the access level, it can determine that the user does not have the access authority to the data to be accessed.

[0123] S13: When the authority level of the user is greater than or equal to the access level, it is determined that the user has access authority to the data to be accessed.

[0124] If the user's authority level is greater than or equal to the access level of the data to be accessed, the user has the authority to access the data to be accessed. Therefore, when the data access system determines that the user's authority level is greater than or equal to the access level, it can determine that the user has the access authority to the data to be accessed.

[0125] Step 202: If the user has access rights to the data to be accessed, determine whether there is sensitive data in the data to be accessed;

[0126] Step 203: if there is no sensitive data in the data to be accessed, obtain the access data set of the user;

[0127] In the embodiment of the present invention, a behavior abnormality degree can be used to indicate the user behavior dynamics. When the user's behavior abnormality degree is high, it can be explained that the user's behavior is abnormal, and when the user's behavior abnormality degree is low, it can be explained that the user's behavior is normal. Specifically, after determining that there is no sensitive data in the data to be accessed, the data access system can calculate the user's behavior abnormality degree, and the user's behavior abnormality degree can be determined based on the user's historical access behavior, that is, it can be determined based on the user's historical access data set, so the user's access data set can be obtained first.

[0128] In an embodiment of the present invention, if there is no sensitive data in the data to be accessed, obtaining the access data set of the user includes:

[0129] S21, if there is no sensitive data in the data to be accessed, obtain all data accessed by the user after the current login and before the current access, to obtain the access data set of the user;

[0130] In order to determine the abnormality of the user's behavior, the user's access data set can be obtained. For the acquisition of the user's access data set, since the behavior of the user closest to the user's current access behavior can best reflect whether the current access behavior is normal, the data closest to the current access can be obtained as the user's access data set, that is, all the data accessed by the user after logging in and before the current access can be obtained to obtain the user's access data set. In addition, the access data in the current access data set are arranged from far to near according to the access time.

[0131] S22, if the data accessed by the user after the current login and before the current visit is not obtained, then all the data accessed during the historical logins within a preset time period are obtained to obtain the access data set of the user.

[0132] The user's current visit may also be the user's first visit after logging in. In this case, all the data of the historical logins within a preset time period can be obtained as the user's access data set. In actual implementation, all the data of the most recent login can be obtained as the user's access data set.

[0133] Step 204, determining the abnormality of the user's behavior according to the access data set;

[0134] After obtaining the user's access data set, the data in the access data set can be analyzed and processed to determine the abnormality of the user's behavior.

[0135] In one embodiment of the present invention, determining the abnormality of the user's behavior according to the access data set includes:

[0136] S31, if the access data set is an empty set, determining that the abnormality degree of the user's behavior is a preset minimum value;

[0137] This visit by the user may be the first visit to the data after the user registers. At this time, the access data set obtained may be an empty set, so a minimum value may be preset as the abnormal behavior degree of the user who visits for the first time.

[0138] S32, if the access data set is not empty, respectively calculating the device value and access value of each access data in the access data set; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users;

[0139] If the acquired access data set is not an empty set, the user's behavior abnormality can be determined based on all access data in the access data set, specifically, based on the device value and access value of each access data in the access data set.

[0140] The device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period. Specifically, for access data j, the security rating software on the storage device where the access data j is located can be used to perform a security rating on the storage device to obtain a rating value A. j ; Then obtain the preset theoretical safety rating maximum value max j And the theoretical safety rating minimum min j ; Then obtain the maximum value max0 and the minimum value min0 of the actual security rating of the storage device within a preset time period (such as the last day, the last week, etc.); Finally, calculate the device value for accessing data j:

[0141]

[0142] I j It represents the security of the data storage device corresponding to the access data j. Since devices with weak security are more likely to have security problems, I j The value can reflect whether the device is prone to abnormal behavior. The larger the value, the safer it is and the less likely it is to have security issues.

[0143] The access value is the ratio of the number of historical users with the same permission level as the user to the total number of historical users who have accessed the access data. Specifically, for access data j, all users who access element j within a preset time period can be obtained, and the access rights of each user and the total number of users n can be counted. all ; Next, among all users’ access rights, determine the number of users n that have the same access rights as the user s ; Finally, determine the access value of element j:

[0144]

[0145] v jIt represents the proportion of other users who have the same permissions as the current access user and access the element data. The larger the value is, the more users with the same permissions access the element data, and the more normal the user's access behavior is.

[0146] S33, determining the abnormality of the user's behavior according to the device value and the access value of each access data.

[0147] After determining the device value and the access value of each access data, the abnormality of the user's behavior may be determined using the device value and the access value of the access data.

[0148] The details are as follows:

[0149] (1) Calculate the differences in the device values ​​between two adjacent elements in the currently accessed data set in sequence, and form a difference sequence from the differences.

[0150] The difference is the difference between the device value of the next accessed data and the device value of the previous accessed data. For the last accessed data, the difference is the difference between the device value of the device where the currently accessed data is located and the device value of the last accessed data.

[0151] For example, if the access dataset is {d1, d2, ...d x}, then r1=I2-I1, r2=I3-I2,…, r x =I x+1 -I x , forming a difference sequence {r1, r2, ..., r x}.

[0152] Among them, I1 is the device value of the device where d1 is located, I2 is the device value of the device where d2 is located, and I3 is the device value of the device where d3 is located. x is d x The device value of the device, I x+1 The device value of the device where the data to be accessed is located.

[0153] The sign of the difference reflects the relationship between the device value of the subsequent access data and the device value of the previous access data in the current access data set. For example, if the sign of the difference is positive, it is confirmed that the device value of the subsequent access data is greater than the security value of the previous access data, that is, the storage device of the subsequent access data is safer than the storage device of the previous access data. If the sign of the difference is negative, it is confirmed that the device value of the subsequent access data is less than the security value of the previous access data, that is, the storage device of the previous access data is safer.

[0154] The size of the difference reflects the gap in security between the two devices.

[0155] (2) Divide the difference sequence into segments, where each segment consists of consecutive elements with the same sign.

[0156] If the difference is 0, it is included in the previous segment.

[0157] For example, if the difference sequence is {0.1,-0.1,-0.2,0,0.05,0.1}, it will be divided into 3 segments, namely {0.1}, {-0.1,-0.2,0}, and {0.05,0.1}.

[0158] (3) Among the segments with positive difference values, determine the segment containing the most access data (for the convenience of description, record it as segment +), and record the number of elements it contains I + , among the segments with negative difference, determine the segment containing the most access data (for the convenience of description, record it as segment -), and record the number of access data it contains I - .

[0159] (4) Calculate the standard deviation σ of all values ​​in segment + + , and the standard deviation σ of all values ​​in segment- - .

[0160] The standard deviation represents the degree of difference between all access data in a segment. The larger the value, the greater the difference between the differences in the segment, and the access behavior is considered irregular. The smaller the value, the smaller the difference between the differences in the segment, and the access behavior is considered regular.

[0161] In an abnormal attack, the attacker will select target devices to attack. If the target devices have similar characteristics, the access behavior of the data before and after will be more regular.

[0162] (5) Calculation of behavioral abnormality:

[0163]

[0164] Step 205, performing protection processing on the data to be accessed according to the abnormality of the user's behavior to obtain first target data; the protection processing includes encryption and desensitization;

[0165] In one embodiment of the present invention, according to the abnormality of the user's behavior, protection processing is performed on the data to be accessed to obtain the first target data, including:

[0166] S41, querying at least one historical user who has accessed the data to be accessed;

[0167] Whether the user behavior is abnormal can be determined by comparing the user's behavior abnormality with the behavior abnormality of other users who accessed the data to be accessed. Therefore, after determining the user's behavior abnormality, the behavior abnormality of historical users who have accessed the data to be accessed can be determined.

[0168] Specifically, at least one historical user who has accessed the data to be accessed may be queried first. If there are many historical users who have accessed the data to be accessed, a preset number of users may be randomly selected, or a preset number of users may be selected from recent to earliest access time.

[0169] S42, obtaining all data accessed by each of the historical users after logging in and before accessing the data to be accessed, and obtaining access data sets of each of the historical users respectively;

[0170] After determining the historical users, all data accessed by each historical user after logging in and before accessing the data to be accessed can be obtained to obtain the access data set of each historical user, and the abnormal behavior of each historical user can be determined based on the access data set of each historical user.

[0171] S43, using the access data set of each of the historical users, respectively calculating the behavior abnormality degree of each of the historical users;

[0172] After obtaining the access data set of each historical user, the access data set of each historical user may be used to calculate the behavior abnormality of each historical user.

[0173] S44, using the behavior abnormality degree of the historical users, calculating the average behavior abnormality degree of the historical users;

[0174] When there are multiple historical users, the average behavior abnormality of the multiple historical users can be used to compare with the user's behavior abnormality. Therefore, after calculating the behavior abnormality of each historical user, the behavior abnormality of all historical users can be used to calculate the average behavior abnormality of the historical users.

[0175] S45, determining whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold;

[0176] In the embodiment of the present invention, a threshold value can be preset, and the threshold value is used as a standard for comparing the abnormality of the user's behavior with the average abnormality of the historical users' behavior. The intensity of access control can be adjusted by the threshold value, and the smaller the threshold value, the greater the control intensity. In actual applications, the threshold value can be set according to actual conditions, and this application does not limit this.

[0177] After determining the average behavioral abnormality of historical users, the data access system can calculate the difference between the user's behavioral abnormality and the average behavioral abnormality of historical users, and determine whether the difference is greater than a preset threshold. If the difference is greater than the preset threshold, it means that the user behavior is abnormal, and the data to be accessed can be protected to protect non-sensitive data; if the difference is less than or equal to the preset threshold, it means that the user behavior is normal, and the data to be accessed can be directly fed back to the user.

[0178] S46: If yes, determine that the user behavior is abnormal, perform protection processing on the data to be accessed, and obtain the first target data.

[0179] After determining that the difference between the user's behavior abnormality and the average behavior abnormality of historical users is greater than a preset threshold, the data access system can determine that the user behavior is abnormal, perform protection processing on the accessed data, obtain the first target data, and then feed back the first target data to the user.

[0180] Step 206: If there is sensitive data in the data to be accessed, protection processing is performed on the sensitive data in the data to be accessed to obtain second target data;

[0181] Step 207, determining whether the second target data contains non-sensitive data;

[0182] Step 208, if the second target data includes non-sensitive data, determining the abnormality of the user's behavior;

[0183] Step 209, performing protection processing on the second target data according to the abnormality degree of the user's behavior to obtain the first target data;

[0184] Step 210: Feedback the first target data to the user.

[0185] In one embodiment of the present invention, the method further comprises:

[0186] S51: If the second target data does not include the non-sensitive data, the second target data is fed back to the user.

[0187] When the data access system determines that the second target data does not contain non-sensitive data, it may no longer perform protection processing on the second target data and directly feed back the second target data to the user.

[0188] Reference Figure 3 , shows a flowchart of controlling data access provided in an embodiment of the present invention.

[0189] 1. When the user logs in and initiates a data access request, obtain the data accessed by the user;

[0190] 2. Determine whether the user has access rights to the data based on the user's permission level and the data access level;

[0191] 3. If the user does not have access rights, a feedback indicating that the user has no access rights is given and the data access control process ends; if the user has access rights, a determination is made as to whether there is sensitive data in the data to be accessed. If so, the sensitive data in the data to be accessed is desensitized or encrypted to obtain the second target data;

[0192] 4. If the second target data does not include non-sensitive data, the second target data is directly fed back to the user; if the second target data also includes non-sensitive data, the abnormality of the user's behavior is determined;

[0193] 5. Encrypt or desensitize the second target data according to the abnormality of the user's behavior to obtain the first target data, and feed the first target data back to the user.

[0194] Through the data access method of the embodiment of the present invention, after the user logs in, the data access system receives the data access request sent by the user, determines whether the user has the access right to the data to be accessed corresponding to the data access request, and if the user has the access right to the data to be accessed, determines whether there is sensitive data in the data to be accessed, and if there is no sensitive data in the data to be accessed, determines the abnormality of the user's behavior, and performs protection processing on the data to be accessed according to the abnormality of the user's behavior to obtain the first target data; if there is sensitive data in the data to be accessed, performs protection processing on the sensitive data in the data to be accessed to obtain the second target data, and then determines whether the second target data contains non-sensitive data. If the second target data contains non-sensitive data, determines the abnormality of the user's behavior, and performs protection processing on the second target data according to the abnormality of the user's behavior to obtain the first target data; and feeds the first target data back to the user. In the case where the user has the access right, the method of the present invention performs protection processing on the sensitive data in the data accessed by the user, and further performs protection processing on the non-sensitive data according to the abnormality of the user's behavior, so that it can dynamically determine whether to provide data and what data to provide based on the user's access behavior, which not only ensures the security of sensitive data, but also avoids the abnormal leakage of non-sensitive data.

[0195] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0196] Reference Figure 4 , shows a structural block diagram of a data access device provided in an embodiment of the present invention, which may specifically include the following modules:

[0197] The receiving module 401 is used to receive a data access request sent by a user after the user logs in, and determine whether the user has access rights to the data to be accessed corresponding to the data access request;

[0198] A sensitive data determination module 402, configured to determine whether there is sensitive data in the data to be accessed if the user has access rights to the data to be accessed;

[0199] A first behavior abnormality determination module 403, configured to determine the user's behavior abnormality if no sensitive data exists in the data to be accessed;

[0200] The to-be-accessed data processing module 404 is used to perform protection processing on the to-be-accessed data according to the abnormality of the user's behavior to obtain the first target data; the protection processing includes encryption and desensitization;

[0201] The sensitive data processing module 405 is used to perform protection processing on the sensitive data in the data to be accessed if there is sensitive data in the data to be accessed, so as to obtain second target data;

[0202] A non-sensitive data determination module 406, configured to determine whether the second target data contains non-sensitive data;

[0203] A second behavior abnormality determination module 407, configured to determine the user's behavior abnormality if the second target data includes non-sensitive data;

[0204] A second target data processing module 408 is used to perform protection processing on the second target data according to the abnormality of the user's behavior to obtain the first target data;

[0205] The feedback module 409 is used to feed back the first target data to the user.

[0206] Optionally, the data access request includes the permission level of the user, and the data to be accessed is set with an access level;

[0207] The receiving module comprises:

[0208] An access permission judgment submodule, used to judge whether the user is allowed to access the data to be accessed according to the permission level of the user and the access level of the data to be accessed;

[0209] A first determination submodule, configured to determine that the user does not have access rights to the data to be accessed when the user's authority level is lower than the access level;

[0210] The second determining submodule is configured to determine that the user has access rights to the data to be accessed when the user's authority level is greater than or equal to the access level.

[0211] Optionally, the first behavior abnormality determination module includes:

[0212] An access data set acquisition submodule, used for acquiring the access data set of the user if no sensitive data exists in the data to be accessed;

[0213] The behavior abnormality determination submodule is used to determine the user's behavior abnormality based on the access data set.

[0214] Optionally, the accessing data set acquisition submodule includes:

[0215] A first access data set acquisition unit is used to acquire all data accessed by the user after the current login and before the current access, if there is no sensitive data in the data to be accessed, to obtain the access data set of the user;

[0216] The second access data set acquisition unit is used to acquire all data accessed during historical logins within a preset time period to obtain the access data set of the user if the data accessed by the user before the current visit after the current login is not acquired.

[0217] Optionally, the behavior abnormality determination submodule includes:

[0218] A first behavior abnormality determination unit, configured to determine that the user's behavior abnormality is a preset minimum value if the access data set is an empty set;

[0219] a device value and access value determination unit, configured to respectively calculate the device value and access value of each access data in the access data set if the access data set is not empty; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users;

[0220] The second behavior abnormality determination unit is used to determine the user's behavior abnormality according to the device value and the access value of each access data.

[0221] Optionally, the to-be-accessed data processing module includes:

[0222] A query submodule, used for querying at least one historical user who has accessed the data to be accessed;

[0223] A historical user access data set acquisition submodule is used to acquire all data accessed by each historical user after logging in and before accessing the data to be accessed, and obtain access data sets of each historical user respectively;

[0224] A historical user behavior abnormality determination submodule is used to use the access data set of each historical user to calculate the behavior abnormality of each historical user;

[0225] An average behavior abnormality determination submodule is used to calculate the average behavior abnormality of the historical users by using the behavior abnormality of the historical users;

[0226] A judgment submodule, used to judge whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold;

[0227] The to-be-accessed data processing submodule is used to determine that the user behavior is abnormal, perform protection processing on the to-be-accessed data, and obtain the first target data.

[0228] Optionally, the device further comprises:

[0229] A sending module is used to feed back the second target data to the user if the second target data does not include the non-sensitive data.

[0230] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0231] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0232] Memory 503, used for storing computer programs;

[0233] The processor 501 is used to execute the program stored in the memory 503, and implements the following steps:

[0234] After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the data to be accessed corresponding to the data access request;

[0235] If the user has access rights to the data to be accessed, determining whether there is sensitive data in the data to be accessed;

[0236] If there is no sensitive data in the data to be accessed, determining the abnormality of the user's behavior;

[0237] According to the abnormality of the user's behavior, protection processing is performed on the data to be accessed to obtain first target data; the protection processing includes encryption and desensitization;

[0238] If there is sensitive data in the data to be accessed, protection processing is performed on the sensitive data in the data to be accessed to obtain second target data;

[0239] Determining whether the second target data includes non-sensitive data;

[0240] If the second target data includes non-sensitive data, determining the abnormality of the user's behavior;

[0241] According to the abnormality degree of the user's behavior, protection processing is performed on the second target data to obtain the first target data;

[0242] The first target data is fed back to the user.

[0243] Optionally, the data access request includes the permission level of the user, and the data to be accessed is set with an access level;

[0244] After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request, includes:

[0245] Determining whether the user is allowed to access the data to be accessed according to the authority level of the user and the access level of the data to be accessed;

[0246] When the authority level of the user is lower than the access level, determining that the user does not have access authority to the data to be accessed;

[0247] When the authority level of the user is greater than or equal to the access level, it is determined that the user has access authority to the data to be accessed.

[0248] Optionally, if there is no sensitive data in the data to be accessed, determining the abnormality of the user's behavior includes:

[0249] If there is no sensitive data in the data to be accessed, obtaining an access data set of the user;

[0250] The abnormality degree of the user's behavior is determined according to the access data set.

[0251] Optionally, if there is no sensitive data in the data to be accessed, obtaining the access data set of the user includes:

[0252] If there is no sensitive data in the data to be accessed, all data accessed by the user after logging in this time and before the current access are obtained to obtain the access data set of the user;

[0253] If the data accessed by the user after the current login and before the current visit is not obtained, then all the data accessed during the historical logins within a preset time period are obtained to obtain the access data set of the user.

[0254] Optionally, determining the abnormality of the user's behavior according to the access data set includes:

[0255] If the access data set is an empty set, determining that the user's behavior abnormality is a preset minimum value;

[0256] If the access data set is not empty, the device value and access value of each access data in the access data set are calculated respectively; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users;

[0257] The abnormality degree of the user's behavior is determined according to the device value and the access value of each access data.

[0258] Optionally, according to the abnormality of the user's behavior, performing protection processing on the data to be accessed to obtain the first target data includes:

[0259] Query at least one historical user who has accessed the data to be accessed;

[0260] Obtain all data accessed by each of the historical users after logging in and before accessing the data to be accessed, and obtain access data sets of each of the historical users respectively;

[0261] Using the access data set of each of the historical users, respectively calculating the behavior abnormality of each of the historical users;

[0262] The behavior abnormality of the historical users is used to calculate the average behavior abnormality of the historical users;

[0263] Determine whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold;

[0264] If so, it is determined that the user behavior is abnormal, and protection processing is performed on the data to be accessed to obtain the first target data.

[0265] Optionally, the method further comprises:

[0266] If the second target data does not include the non-sensitive data, the second target data is fed back to the user.

[0267] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0268] The communication interface is used for communication between the above terminal and other devices.

[0269] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0270] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0271] like Figure 6 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 601 is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the data access method described in the above embodiment.

[0272] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes the data access method described in the above embodiment.

[0273] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0274] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0275] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0276] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A data access method, characterized in that: Applied to a data access system, the data access system records data accessed by each user, including: After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the data to be accessed corresponding to the data access request; If the user has access rights to the data to be accessed, determining whether there is sensitive data in the data to be accessed; If the sensitive data does not exist in the data to be accessed, determining the abnormality of the user's behavior; According to the abnormality of the user's behavior, protection processing is performed on the data to be accessed to obtain first target data; the protection processing includes encryption and desensitization; If there is sensitive data in the data to be accessed, performing the protection process on the sensitive data in the data to be accessed to obtain second target data; Determining whether the second target data includes non-sensitive data; If the second target data includes non-sensitive data, determining the abnormality of the user's behavior; According to the abnormality degree of the user's behavior, protection processing is performed on the second target data to obtain the first target data; The first target data is fed back to the user.

2. The method according to claim 1, characterized in that The data access request includes the permission level of the user, and the data to be accessed is set with an access level; After the user logs in, receiving a data access request sent by the user, and determining whether the user has access rights to the to-be-accessed data corresponding to the data access request, includes: Determining whether the user is allowed to access the data to be accessed according to the authority level of the user and the access level of the data to be accessed; When the authority level of the user is lower than the access level, determining that the user does not have access authority to the data to be accessed; When the authority level of the user is greater than or equal to the access level, it is determined that the user has access rights to the data to be accessed.

3. The method according to claim 1, characterized in that If the data to be accessed does not contain sensitive data, determining the abnormality of the user's behavior includes: If there is no sensitive data in the data to be accessed, obtaining an access data set of the user; The abnormality degree of the user's behavior is determined according to the access data set.

4. The method according to claim 3, characterized in that: If there is no sensitive data in the data to be accessed, obtaining the access data set of the user includes: If there is no sensitive data in the data to be accessed, all data accessed by the user after logging in this time and before the current access are obtained to obtain the access data set of the user; If the data accessed by the user after the current login and before the current visit is not obtained, then all the data accessed during the historical logins within a preset time period are obtained to obtain the access data set of the user.

5. The method according to claim 3, characterized in that: Determining the abnormality of the user's behavior according to the access data set includes: If the access data set is an empty set, determining that the user's behavior abnormality is a preset minimum value; If the access data set is not empty, the device value and access value of each access data in the access data set are calculated respectively; the device value is the difference between the security rating value of the access data and the maximum rating value of the device storing the access data within a preset period; the access value is the ratio of the number of historical users who have the same authority level as the user among the historical users who accessed the access data to the total number of historical users; The abnormality degree of the user's behavior is determined according to the device value and the access value of each access data.

6. The method according to claim 1, characterized in that According to the abnormality of the user's behavior, protection processing is performed on the data to be accessed to obtain first target data, including: Query at least one historical user who has accessed the data to be accessed; Obtain all data accessed by each of the historical users after logging in and before accessing the data to be accessed, and obtain access data sets of each of the historical users respectively; Using the access data set of each of the historical users, respectively calculating the behavior abnormality of each of the historical users; The behavior abnormality of the historical users is used to calculate the average behavior abnormality of the historical users; Determine whether the difference between the user's behavior abnormality and the average behavior abnormality of the historical users is greater than a preset threshold; If so, it is determined that the user behavior is abnormal, and protection processing is performed on the data to be accessed to obtain the first target data.

7. The method according to claim 1, characterized in that The method further comprises: If the second target data does not include the non-sensitive data, the second target data is fed back to the user.

8. A data access device, characterized in that: Applied to a data access system, the data access system records data accessed by each user, including: A receiving module, used to receive a data access request sent by a user after the user logs in, and determine whether the user has access rights to the data to be accessed corresponding to the data access request; A sensitive data determination module, configured to determine whether there is sensitive data in the data to be accessed if the user has access rights to the data to be accessed; A first behavior abnormality determination module, configured to determine the user's behavior abnormality if no sensitive data exists in the data to be accessed; A to-be-accessed data processing module, used to perform protection processing on the to-be-accessed data according to the abnormality of the user's behavior to obtain first target data; the protection processing includes encryption and desensitization; A sensitive data processing module, configured to, if there is sensitive data in the data to be accessed, perform protection processing on the sensitive data in the data to be accessed to obtain second target data; a non-sensitive data determination module, configured to determine whether the second target data contains non-sensitive data; a second behavior abnormality determination module, configured to determine the user's behavior abnormality if the second target data includes non-sensitive data; A second target data processing module, configured to perform protection processing on the second target data according to the abnormality degree of the user's behavior to obtain first target data; A feedback module is used to feed back the first target data to the user.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. One or more computer-readable media having instructions stored thereon, which when executed by one or more processors cause the processors to perform the method according to any one of claims 1 to 7.

Images