A control method and system based on big data and electronic equipment

Abstract

The application discloses a control method based on big data, and relates to the technical field of control systems, and comprises the following steps: S1, acquiring user information, a first mapping relationship and historical access logs; S2, obtaining first role information associated with first permission information according to the user information and the first mapping relationship; S3, obtaining second permission information according to the historical access logs; S4, calculating the similarity of the first permission information and the second permission information, and judging whether the similarity is less than a preset threshold value; S5, if yes, obtaining second role information associated with the second permission information, generating a second mapping relationship according to the second role information and the user information, and covering the first mapping relationship with the second mapping relationship, wherein the second role information can be obtained according to the user information and the second mapping relationship; and the application further provides a control system based on big data. The application has the advantages of high security.

Description

Technical Field

[0001] This invention relates to the field of control system technology, and more specifically to a control method, system, and electronic device based on big data. Background Technology

[0002] With the continuous improvement of social informatization and networking, as well as the development and application of emerging technologies such as cloud computing and the Internet of Things, an era of large-scale production, sharing and application of data has arrived. However, since data and computing power are usually sufficient in big data environments, various sensitive information scattered in big data applications can be more easily obtained and correlated, resulting in more serious security threats to big data in terms of collection, storage, sharing and utilization compared to ordinary data. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a control method, system, and electronic device based on big data.

[0004] A big data-based control method includes the following steps: S1, obtaining user information, a first mapping relationship, and historical access logs; S2, obtaining first role information associated with first permission information based on the user information and the first mapping relationship; S3, obtaining second permission information based on the historical access logs.

[0005] S4. Calculate the similarity between the first permission information and the second permission information, and determine whether the similarity is less than a preset threshold; S5. If so, obtain the second role information associated with the second permission information, and generate a second mapping relationship based on the second role information and user information, and overwrite the first mapping relationship with the second mapping relationship. The second role information can be obtained based on the user information and the second mapping relationship. The steps of the entire control method are as follows: S1. Obtain user information, the first mapping relationship, and historical access logs. The first mapping relationship is defined by the security administrator. This access control authorization behavior is inherently labor-intensive. When facing massive and complex big data, administrators find it even more difficult to implement this labor-intensive authorization management operation. Therefore, they often grant users too many or even all access permissions to ensure that users can use the system smoothly. For example, in medical big data systems, medical researchers can access some of the patient's clinical data. Since determining "which part of the patient's clinical data can be viewed by medical researchers" requires highly specialized medical knowledge, these systems often use over-authorization to avoid affecting research work; S2. Obtain the first role information associated with the first permission information based on the user information and the first mapping relationship. The first role information is the basis for authorization management operations. S3. Based on the second permission information obtained from the historical access log, extract the user's permission usage records and the permission information they represent from the access log; S4. Calculate the similarity between the first permission information and the second permission information, and determine whether the similarity is less than a preset threshold. The similarity is the expected value in a machine learning algorithm, which can be set manually or supplemented by the machine algorithm. The lower the similarity between the first permission information and the second permission information, the more initially over-authorized permission information there is; S5. If the similarity is less than the preset threshold, it means that the over-authorization has exceeded the threshold. Then, obtain the second role information associated with the second permission information, and generate a second mapping relationship based on the second role information and user information. The new second mapping relationship overwrites the first mapping relationship, so that the second role information and the user relationship are mutually associated, and the second role information is associated with the second permission information with a small amount of authorization.In summary, the entire control method automates role definition and management based on the existing user and permission allocation relationships within the system, reducing reliance on administrators. Furthermore, assuming the system initially has simple access control ("which users can access which resources"), role information mining identifies potential "secondary mapping relationships" from these existing user and permission allocation relationships, associating role information with user information and role information with permission information respectively. Further, addressing the potential for errors in existing user and permission allocation, role information mining is performed on access logs. This approach processes and analyzes access logs, aiming to generate role information and mapping relationships based on actual permission usage. The result of this role information mining method, which fully considers actual permission usage, better meets the system's actual security needs and effectively reduces over-authorization of access permissions.

[0006] Preferably, S4 includes: S41, dividing the first permission information to obtain multiple first permission risk zones; S42, dividing the second permission information to obtain multiple second permission risk zones; S43, obtaining multiple first valid permission risk zones based on the risk range and the first permission risk zones; S44, obtaining multiple second valid permission risk zones based on the risk range and the second permission risk zones; S45, calculating the similarity between the first valid permission risk zones and the second valid permission risk zones; S46, determining whether the similarity is less than a preset threshold. Regarding the over-authorization phenomenon, some permissions that are not frequently used by users are basic permissions and do not pose a risk, such as basic information registration and non-user privacy information. If a user accesses this content through permissions, the probability is extremely low, and subsequent reduction of authorization cannot reduce this risk. Therefore, a permission risk zone is pre-set, and content outside the permission risk zone is not included in the similarity calculation, which can improve the reliability of the process of reducing over-authorization.

[0007] Preferably, the risk range includes a strict denial boundary and a strict allow boundary, with the first effective permission risk zone and the second effective permission risk zone located between the strict denial boundary and the strict allow boundary. When the permission risk exceeds the portion of the permission information outside the strict denial boundary, authorized access must be denied; when the permission risk is within the strict allow boundary, authorized access must be allowed.

[0008] Preferably, step S41 includes: dividing the first permission information into multiple first permission risk zones according to a risk assessment method; step S42 includes: dividing the second permission information into multiple second permission risk zones according to a risk assessment method. Based on the access request and the risk assessment method, a risk value can be generated for the authorized access, thereby quickly dividing the permission risk zones.

[0009] Preferably, S5 includes: S51, if the similarity is less than a preset threshold, then obtain the second role information associated with the second permission information; S52, generate a second mapping relationship based on the second role information and user information; S53, overwrite the first mapping relationship with the second mapping relationship.

[0010] A big data-based control system is also provided, characterized in that the system includes: a transmission module for acquiring user information, a first mapping relationship, and historical access logs; a first processing module for obtaining first role information associated with first permission information based on the user information and the first mapping relationship; a second processing module for obtaining second permission information based on the historical access logs; a judgment module for calculating the similarity between the first permission information and the second permission information, and judging whether the similarity is less than a preset threshold; and a control module for acquiring second role information associated with second permission information when the similarity is less than the preset threshold, generating a second mapping relationship based on the second role information and user information, and overwriting the first mapping relationship with the second mapping relationship, wherein the second role information can be obtained based on the user information and the second mapping relationship. The transmission module is used to execute step S1; the first processing module is used to execute step S2; the second processing module is used to execute step S3; the judgment module is used to execute step S4; and the control module is used to execute step S5.

[0011] Preferably, the judgment module includes: a first division unit, used to divide the first permission information to obtain multiple first permission risk bands; a second division unit, used to divide the second permission information to obtain multiple second permission risk bands; a first calculation unit, used to obtain multiple first valid permission risk bands based on the risk range and the first permission risk bands; a second calculation unit, used to obtain multiple second valid permission risk bands based on the risk range and the second permission risk bands; a third calculation unit, used to calculate the similarity between the first valid permission risk bands and the second valid permission risk bands; and a judgment unit, used to determine whether the similarity is less than a preset threshold. The first division unit is used to execute step S41; the second division unit is used to execute step S42; the first calculation unit is used to execute step S43; the second calculation unit is used to execute step S44; the third calculation unit is used to execute step S45; and the judgment unit is used to execute step S46.

[0012] Preferably, the control module includes: an association unit, used to obtain second role information associated with second permission information when the similarity is less than a preset threshold; a generation unit, used to generate a second mapping relationship based on the second role information and user information; and an overlay unit, used to overlay the first mapping relationship with the second mapping relationship. The association unit is used to execute step S51; the generation unit is used to execute step S52; and the overlay unit is used to execute step S53.

[0013] The beneficial effects of this invention are reflected in:

[0014] In this invention, the entire control method automatically implements role definition and management based on the existing user and permission allocation relationships in the system, thereby reducing reliance on administrators. Furthermore, assuming the system already has simple access control in its initial state ("which users can access which resources"), role information mining will identify potential "secondary mapping relationships" from these existing user and permission allocation relationships, and associate role information with user information and role information with permission information respectively. Furthermore, addressing the potential for errors in the existing user and permission information allocation, role information mining is performed on access logs. This scheme processes and analyzes access logs, aiming to generate role information and mapping relationships based on the actual usage of permissions. The result is a role information mining method that fully considers the actual usage of permissions, which is more in line with the actual security needs of the system and effectively reduces the phenomenon of over-authorization of access permissions. Attached Figure Description

[0015] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0016] Figure 1 This is a schematic diagram illustrating the steps of a big data-based control method provided in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the steps in the big data-based control method S4 provided in an embodiment of the present invention;

[0018] Figure 3 This is a schematic diagram of the steps in the big data-based control method S5 provided in an embodiment of the present invention;

[0019] Figure 4 A schematic diagram of the structure of a big data-based control system provided in an embodiment of the present invention;

[0020] Figure 5 A schematic diagram of the structure of the judgment module of the big data-based control system provided in an embodiment of the present invention;

[0021] Figure 6 A schematic diagram of the control module structure of the big data-based control system provided in an embodiment of the present invention;

[0022] Figure 7 This is a schematic diagram of the effective permission risk zone division based on big data, provided for an embodiment of the present invention.

[0023] Figure label:

[0024] 100 - Transmission module, 200 - First processing module, 300 - Second processing module, 400 - Judgment module, 410 - First partitioning unit, 420 - Second partitioning unit, 430 - First calculation unit, 440 - Second calculation unit, 450 - Third calculation unit, 460 - Judgment unit, 500 - Control module, 510 - Association unit, 520 - Generation unit, 530 - Covering unit. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0026] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0027] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0028] In the description of the embodiments of the present invention, it should be noted that the terms "inner", "outer", "upper", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of the invention is usually placed when in use. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting the present invention.

[0029] like Figures 1 to 3 , Figure 7As shown, a big data-based control method includes the following steps: S1, obtaining user information, a first mapping relationship, and historical access logs; S2, obtaining first role information associated with first permission information based on the user information and the first mapping relationship; S3, obtaining second permission information based on the historical access logs; S4, calculating the similarity between the first permission information and the second permission information, and determining whether the similarity is less than a preset threshold; S5, if so, obtaining second role information associated with the second permission information, generating a second mapping relationship based on the second role information and user information, and overwriting the first mapping relationship with the second mapping relationship, wherein the second role information can be obtained based on the user information and the second mapping relationship.

[0030] In this embodiment, it should be noted that the steps of the entire control method are as follows: S1. Obtain user information, a first mapping relationship, and historical access logs. The first mapping relationship is defined by the security administrator. This access control authorization behavior is inherently labor-intensive. When faced with massive and complex big data, it is even more difficult for administrators to implement this labor-intensive authorization management operation. Therefore, they often grant users too many or even all access permissions to ensure that users can use the system smoothly. For example, in medical big data systems, medical researchers can access some of the patient's clinical data. Since determining "which part of the patient's clinical data can be viewed by medical researchers" requires highly specialized medical knowledge, these systems often adopt over-authorization to avoid affecting research work; S2. Obtain first role information associated with first permission information based on user information and the first mapping relationship. The first role information is the authorization management operation. Based on the following steps: S3, the first permission information is over-authorized permission information; S4, based on the second permission information obtained from the historical access logs, extract the user's permission usage records and the permission information they represent from the access logs; S5, calculate the similarity between the first permission information and the second permission information, and determine whether the similarity is less than a preset threshold. The similarity is the expected value in a machine learning algorithm, which can be set manually or supplemented by the machine algorithm. The lower the similarity between the first permission information and the second permission information, the more over-authorized permission information there is initially; S6, if the similarity is less than the preset threshold, it means that the over-authorization has exceeded the threshold. Then, obtain the second role information associated with the second permission information, and generate a second mapping relationship based on the second role information and user information. The new second mapping relationship overwrites the first mapping relationship, so that the second role information and the user relationship are mutually associated, and the second role information is associated with the second permission information with a small amount of authorization.

[0031] In summary, the entire control method automates role definition and management based on the existing user and permission allocation relationships within the system, reducing reliance on administrators. Furthermore, assuming the system initially has simple access control ("which users can access which resources"), role information mining identifies potential "secondary mapping relationships" from these existing user and permission allocation relationships, associating role information with user information and role information with permission information respectively. Further, addressing the potential for errors in existing user and permission allocation, role information mining is performed on access logs. This approach processes and analyzes access logs, aiming to generate role information and mapping relationships based on actual permission usage. The result of this role information mining method, which fully considers actual permission usage, better meets the system's actual security needs and effectively reduces over-authorization of access permissions.

[0032] Specifically, S4 includes: S41, dividing the first permission information to obtain multiple first permission risk zones; S42, dividing the second permission information to obtain multiple second permission risk zones; S43, obtaining multiple first valid permission risk zones based on the risk range and the first permission risk zones; S44, obtaining multiple second valid permission risk zones based on the risk range and the second permission risk zones; S45, calculating the similarity between the first valid permission risk zones and the second valid permission risk zones; S46, determining whether the similarity is less than a preset threshold.

[0033] In this embodiment, it should be noted that, regarding the over-authorization phenomenon, some permissions that are not frequently used by users are basic permissions and do not pose a risk. These include basic information registration, non-user privacy information, etc. If a user accesses this content through permissions, the probability of this happening is extremely low. Subsequent reduction of authorization cannot reduce this risk. Therefore, a permission risk zone is pre-set. Content outside the permission risk zone is not included in the similarity calculation, which can improve the reliability of the process of reducing over-authorization.

[0034] Specifically, the risk range includes a strict rejection boundary and a strict permission boundary, with the first effective permission risk zone and the second effective permission risk zone located between the strict rejection boundary and the strict permission boundary.

[0035] In this embodiment, it should be noted that when the permission risk exceeds the strict denial boundary for the portion of permission information, authorized access must be denied; when the permission risk is within the strict allow boundary for the portion of permission information, authorized access must be allowed.

[0036] Specifically, S41 includes: dividing the first permission information according to the risk assessment method to obtain multiple first permission risk zones; S42 includes: dividing the second permission information according to the risk assessment method to obtain multiple second permission risk zones.

[0037] In this embodiment, it should be noted that a risk value can be generated for the authorized access based on the access request and risk assessment method, thereby quickly dividing the permission risk zone.

[0038] Specifically, S5 includes: S51, if the similarity is less than a preset threshold, then obtain the second role information associated with the second permission information; S52, generate a second mapping relationship based on the second role information and user information; S53, overwrite the first mapping relationship with the second mapping relationship.

[0039] like Figures 4 to 7 As shown, a big data-based control system is also provided. The system includes: a transmission module 100 for acquiring user information, a first mapping relationship, and historical access logs; a first processing module 200 for acquiring first role information associated with first permission information based on user information and the first mapping relationship; a second processing module 300 for acquiring second permission information from historical access logs; a judgment module 400 for calculating the similarity between the first permission information and the second permission information and determining whether the similarity is less than a preset threshold; and a control module 500 for acquiring second role information associated with second permission information when the similarity is less than the preset threshold, generating a second mapping relationship based on the second role information and user information, and overwriting the first mapping relationship with the second mapping relationship. The second role information can be obtained based on the user information and the second mapping relationship.

[0040] In this embodiment, it should be noted that the transmission module 100 is used to execute step S1; the first processing module 200 is used to execute step S2; the second processing module 300 is used to execute step S3; the judgment module 400 is used to execute step S4; and the control module 500 is used to execute step S5.

[0041] Specifically, the judgment module 400 includes: a first division unit 410, used to divide the first permission information to obtain multiple first permission risk bands; a second division unit 420, used to divide the second permission information to obtain multiple second permission risk bands; a first calculation unit 430, used to obtain multiple first valid permission risk bands based on the risk range and the first permission risk bands; a second calculation unit 440, used to obtain multiple second valid permission risk bands based on the risk range and the second permission risk bands; a third calculation unit 450, used to calculate the similarity between the first valid permission risk bands and the second valid permission risk bands; and a judgment unit 460, used to judge whether the similarity is less than a preset threshold.

[0042] In this embodiment, it should be noted that the first division unit 410 is used to execute step S41; the second division unit 420 is used to execute step S42; the first calculation unit 430 is used to execute step S43; the second calculation unit 440 is used to execute step S44; the third calculation unit 450 is used to execute step S45; and the judgment unit 460 is used to execute step S46.

[0043] Specifically, the control module 500 includes: an association unit 510, used to obtain second role information associated with second permission information when the similarity is less than a preset threshold; a generation unit 520, used to generate a second mapping relationship based on the second role information and user information; and an overlay unit 530, used to overlay the first mapping relationship with the second mapping relationship.

[0044] In this embodiment, it should be noted that the association unit 510 is used to execute step S51; the generation unit 520 is used to execute step S52; and the overlay unit 530 is used to execute step S53.

[0045] It should also be noted that the principles involved in the system implementation are the same as those in the above method implementation, and will not be repeated here.

[0046] Specifically, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the method as described in the above embodiments.

[0047] The processor may be implemented as an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a controller, a microcontroller, a microprocessor, or other electronic components, and is used to execute the methods described in the above embodiments.

[0048] Memory can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0049] Specifically, the present invention also provides a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the method as described in the above embodiments.

[0050] The aforementioned computer-readable storage media can be flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, app store, etc.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A control method based on big data, characterized in that, The method includes: S1. Obtain user information, the first mapping relationship, and historical access logs; S2. Obtain the first role information associated with the first permission information based on the user information and the first mapping relationship; S3. Obtain the second permission information from the historical access logs; S4. Calculate the similarity between the first permission information and the second permission information, and determine whether the similarity is less than a preset threshold. S5. If so, obtain the second role information associated with the second permission information, generate a second mapping relationship based on the second role information and user information, and overwrite the first mapping relationship with the second mapping relationship.

2. The control method based on big data according to claim 1, characterized in that, S4 includes: S41. Divide the first-level permission information to obtain multiple first-level permission risk zones; S42. Divide the second-level permission information to obtain multiple second-level permission risk zones; S43. Obtain multiple first-valid-authority risk zones based on the risk scope and the first-authority risk zone; S44. Obtain multiple second valid authority risk zones based on the risk scope and the second authority risk zone; S45. Calculate the similarity between the first effective permission risk zone and the second effective permission risk zone; S46. Determine whether the similarity is less than the preset threshold.

3. The control method based on big data according to claim 2, characterized in that, The risk range includes a strict rejection boundary and a strict permission boundary, and the first effective permission risk zone and the second effective permission risk zone are located between the strict rejection boundary and the strict permission boundary.

4. The control method based on big data according to claim 3, characterized in that, S41 includes: dividing the first permission information according to the risk assessment method to obtain multiple first permission risk zones; S42 includes: dividing the second permission information according to the risk assessment method to obtain multiple second permission risk zones.

5. A control system based on big data, characterized in that, The system includes: The transmission module is used to obtain user information, the first mapping relationship, and historical access logs; The first processing module is used to obtain the first role information associated with the first permission information based on the user information and the first mapping relationship; The second processing module is used to obtain second permission information from the historical access logs; The judgment module is used to calculate the similarity between the first permission information and the second permission information, and to determine whether the similarity is less than a preset threshold. The control module is used to obtain second role information associated with second permission information when the similarity is less than a preset threshold, generate a second mapping relationship based on the second role information and user information, and overwrite the first mapping relationship with the second mapping relationship.

6. The big data-based control system according to claim 5, characterized in that, The judgment module includes: The first division unit is used to divide the first permission information to obtain multiple first permission risk zones; The second division unit is used to divide the second permission information to obtain multiple second permission risk zones; The first calculation unit is used to obtain multiple first valid permission risk zones based on the risk scope and the first permission risk zone; The second calculation unit is used to obtain multiple second valid permission risk zones based on the risk range and the second permission risk zone. The third calculation unit is used to calculate the similarity between the first effective permission risk zone and the second effective permission risk zone; The judgment unit is used to determine whether the similarity is less than a preset threshold.

7. The big data-based control system according to claim 6, characterized in that, The control module includes: The association unit is used to obtain the second role information with second permission information when the similarity is less than a preset threshold. The generation unit is used to generate a second mapping relationship based on the second role information and user information; A covering unit is used to cover the first mapping relationship with the second mapping relationship.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 4.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.

Images