Intelligent permission dynamic management method, system and terminal for meteorological business system

Abstract

The application belongs to the technical field of meteorological business system dynamic management, and discloses a kind of intelligent permission dynamic management method, system and terminal for meteorological business system, constructs meteorological business system trust value evaluation factor set, role set and permission set;System allocates role according to registration information, establishes user historical behavior archives;When user initiates service request to meteorological business system, the system allocates initial trust value of this request of user according to user role and historical behavior trust value;During user access, the behavior of user is continuously periodically trusted evaluation, and the permission of user is dynamically adjusted according to the result of periodic trust evaluation.The application monitors and continuously evaluates user behavior through trust value evaluation module and permission adjustment module, dynamically adjusts user permission;According to the characteristics of meteorological business, the use control model is refined, which can ensure the operation safety of personnel using meteorological business system and effectively improve the security of meteorological business system.

Description

Technical Field

[0001] This invention belongs to the field of dynamic management technology for meteorological business systems, and particularly relates to an intelligent dynamic permission management method, system and terminal for meteorological business systems. Background Technology

[0002] Currently, with the expansion and extension of meteorological service targets, meteorological operational systems face requests from both domestic and international sources, as well as the resulting malicious attacks, such as malicious tampering with deadline data, unauthorized use of meteorological equipment, and issuing malicious requests. Cross-border services place higher security demands on meteorological operational systems. Access control, used to restrict user access to resources, prevent unauthorized users from entering the system, and prevent legitimate users from unauthorized access to resources, is an indispensable security measure and a research hotspot in the field of information system security. Currently, most meteorological operational systems in use employ role-based access control (RBAC) technology, where multiple roles are defined within the system, and permissions are granted based on these roles, separating users from their permissions from direct user authorization. Its advantages include clear permission division and ease of management, leading to its widespread use. However, this technology suffers from drawbacks such as one-time authorization with lifetime privileges and the inability to dynamically adjust permissions, the inability to perceive system operational status, and relatively lax access control policies that can lead to excessive privileges for certain subjects and uncontrollable data leakage. Meteorological operational systems using this type of access control cannot promptly adjust permissions to prevent threats from continuing to affect the system. To address domestic and international threats, dynamic access control is imperative for existing meteorological operational systems.

[0003] Existing dynamic permission adjustment technologies are mostly based on user behavior assessment, judging whether user behavior conforms to norms, is predictable and manageable, and whether it will cause damage or destruction to equipment and data. Effective and accurate user behavior assessment can enable the system to respond well before being attacked. In existing meteorological business systems, user behavior analysis is mostly used for the research and development and sales of meteorological service products, and has not yet been or is rarely applied to dynamic permission adjustment.

[0004] Meteorological operational systems differ from general information systems, possessing unique operational characteristics. This necessitates the extraction of specific operational requirements and the design of targeted dynamic access control schemes in conjunction with information security technologies, placing them at the intersection of meteorology and information security. There is a severe shortage of personnel who possess both meteorological operational needs and understanding of the operational details of meteorological operational systems, as well as expertise in information security technologies. Therefore, it is essential to rely on extensive communication between technical personnel from both fields to extract key information such as the objects of access control, the timing of adjustments, and the granularity of adjustments, ultimately designing a solution acceptable to both parties. Access control is the most fundamental security safeguard for the entire information system (including meteorological operational systems), and its effectiveness directly impacts the overall security protection of the system. However, existing static access control schemes are inadequate for the security requirements of the new era and urgently need improvement.

[0005] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0006] (1) Existing meteorological business system permission management methods based on role access control technology have problems such as one-time authorization for life and the inability to dynamically adjust permissions, inability to perceive system operation status, and relatively loose access control policies that can easily lead to excessive subject permissions and uncontrollable data leakage risks.

[0007] (2) Existing meteorological business systems that use role-based access control technology cannot adjust permissions in a timely manner when faced with threats, so as to prevent the threatening behavior from continuing to affect the meteorological business system.

[0008] (3) The analysis of user behavior in the existing meteorological business system has not been or rarely applied to the dynamic adjustment of permissions. At the same time, the existing static permission allocation scheme cannot meet the security requirements of the new era. Summary of the Invention

[0009] To address the problems existing in the prior art, this invention provides an intelligent dynamic permission management method, system, and terminal for meteorological business systems.

[0010] This invention is implemented as follows: A method for intelligent dynamic permission management for meteorological operational systems includes: constructing a set of trust value assessment factors, a set of roles, and a set of permissions for the meteorological operational system; users obtain roles based on registration information and establish user historical behavior profiles; when a user initiates a business request to the meteorological operational system, the system assigns an initial trust value to the user's current request based on the user's role and historical behavior trust value; continuously and periodically assessing the user's behavior during the user's access period, dynamically adjusting user permissions based on the periodic trust assessment results, and implementing permission adjustments on an improved "use control model for meteorological operational systems".

[0011] Furthermore, the intelligent dynamic permission management method for meteorological operational systems includes the following steps:

[0012] Step 1: Construct a set of trust value assessment factors, roles, and permissions for the meteorological business system;

[0013] Step 2: New user registration. The system assigns roles to new users based on their registration information and creates a user history profile.

[0014] Step 3: The user initiates an access request, the system performs identity authentication, and assigns an initial trust value to the user's current request based on the user's role and historical behavior trust value;

[0015] Step 4: During the user's access to the system, conduct continuous and periodic trust assessments of the user's behavior and dynamically adjust the user's permissions based on the assessment results.

[0016] Step 5: Improve the usage control model based on the characteristics and business needs of the meteorological business system, and implement dynamic adjustment of permissions on the usage control model oriented towards the meteorological business system.

[0017] Furthermore, the factors, roles, and permission levels in the meteorological business system trust value assessment factor set, role set, and permission set in step one are designed according to the business needs of the meteorological business system and adapted to its characteristics. Specifically, the meteorological business system trust value assessment factor set consists of requester factors, environmental factors, and accessed resource factors, including:

[0018] (1) Requester factors:

[0019] 1) Meteorological Subject Roles: The types of roles held by users requesting access to meteorological operational system data resources. Role types are categorized into public service roles, commercial service roles, technology service roles, and operations and maintenance management roles.

[0020] 2) Permission Level: The user's permission level; different permission levels correspond to access to different meteorological resources, which are in line with the user's role. Users with higher permission levels also have the permissions of users with lower permission levels.

[0021] 3) Meteorological subject trust value: The user's trust value, which serves as the basis for dynamically adjusting user permissions;

[0022] 4) Meteorological subject behavior: The behavior of users during their access to the meteorological business system is recorded in the user behavior table. Dangerous behavior is marked as 1, and normal behavior is marked as 0.

[0023] (2) Environmental factors:

[0024] 1) Environment Level: The environmental status level of the user's region when the user initiates a business request;

[0025] 2) Link security assessment value: The security assessment value of the path through which a user requests access to the meteorological business system;

[0026] 3) Network status assessment value: A comprehensive assessment of the user's network, including a comprehensive assessment value of bandwidth, network latency, network jitter and packet loss rate;

[0027] 4) Resource utilization: The resource usage of meteorological equipment accessed by users during their access to the meteorological business system, including CPU, GPU, memory and storage space resources. An abnormally high resource utilization rate indicates the emergence of a threat.

[0028] (3) Factors related to the accessed resource:

[0029] 1) Validity period of meteorological resources: refers to the validity period of meteorological data. Different validity periods are divided into short-term valid data, medium-term short-term valid data, and long-term valid data.

[0030] 2) Meteorological resource confidentiality levels: Meteorological resources are classified into three levels based on the complexity of the encryption algorithm, including public, confidential, and top secret;

[0031] 3) Meteorological resource trust threshold: The trust threshold for meteorological resources is set by the system administrator. The higher the trust threshold, the more important the meteorological resource is, and the greater the access permissions required.

[0032] Furthermore, step three, which assigns an initial trust value to the user's current request based on role and historical behavior trust value, includes:

[0033] (1) When a user initiates a business request to the meteorological business system for the first time, the initial trust value of this access is evaluated based on the user's role. The maximum value of the role trust value and the maximum value of the role trust value one level lower than the permission level are obtained. The average of the two maximum values ​​is the user's initial trust value for this access.

[0034] (2) Utilize historical behavior trust values ​​recorded in the historical behavior profile to conduct an initial trust value assessment for this visit, analyzing the user's trust values ​​in the long term, medium term, and short term. The user's initial trust value for this visit is T. H (S) The sliding window algorithm is used to calculate and obtain the historical trust values ​​of the most recent N times. The sliding window size Z L Z M Z S Z L >Z M >Z S T H (S)=αT H-L (S)+βT H-M (S)+γT H-S (S), α∈[0,1], β∈[0,1], γ∈[0,1], α+β+γ=1, TH-S (S) records Z each time the window slides. L The mean of each data point is calculated, and then the mean of each data point is taken again to calculate T. H (S) represents the user's initial trust value for this visit.

[0035] Furthermore, step four involves conducting continuous and periodic trust assessments of user behavior, including:

[0036] (1) The user initiates a service request;

[0037] (2) Determine whether the user attributes and meteorological resource attributes match; if they match, proceed to step (3); otherwise, reject the access request.

[0038] (3) Determine whether the user meets the obligations of the access control model. If the user does not meet the obligations, obtain feedback information.

[0039] (4) Obtain the access trust threshold of meteorological resources. If the user’s initial trust value for this access is greater than or equal to the meteorological resource trust threshold, the meteorological resource will issue an access consent instruction; otherwise, the user will receive feedback information.

[0040] (5) Users are granted access to meteorological resources;

[0041] (6) At the end of a cycle, calculate the user cycle trust value T(S), where T(S) = T1(S) = T2(S) = T3(S) = T4(S). If the IP address and geographical location remain consistent and the environmental threat level is 0 or 1, the trust value T1(S) remains unchanged; otherwise, the trust value T1(S) decreases. User behavior is divided into normal behavior and dangerous behavior. Comparing with the dangerous behavior table, if dangerous behavior occurs, the trust value T2(S) decreases. The higher the resource utilization, the lower the trust value T3(S). The link security assessment value and network latency jointly determine the trust value T4(S).

[0042] (7) Based on the trust values ​​T1(S), T2(S), T3(S) and T4(S), obtain the user's current period trust value T(S) = X1T1(S) + X2T2(S) + X3T3(S) + X4T4(S), where X1, X2, X3, X4∈[0,1], X1+X2+X3+X4=1;

[0043] (8) Return to step (2) and start a new round of periodic trust assessment, wherein the initial trust value of this access in step (4) is replaced by the previous round of periodic trust value;

[0044] (9) The user actively issues an instruction to stop using meteorological resources, and the access ends.

[0045] Furthermore, the "use control model for meteorological operational systems" formed by improving the use control model based on the characteristics and operational needs of the meteorological operational system in step five includes:

[0046] (1) The access control model for the meteorological business system is the MS-UCON model. The subject and object of the MS-UCON model are corrected to meteorological subject and meteorological object. The meteorological subject is the user accessing the meteorological business system, and the meteorological object is the meteorological resource. Corresponding attributes are added to the meteorological subject and meteorological object.

[0047] (2) Add a periodic trust assessment module on the basis of the control model. Use the periodic trust assessment module to monitor and periodically assess the user’s behavior in real time. Add trust values ​​and trust thresholds for meteorological subjects and meteorological objects respectively to determine whether the user finally obtains the right to access meteorological resources.

[0048] (3) The set of factors for the trust value assessment of the meteorological business system is used in the periodic trust assessment module, and the assessment results are fed back to the permission management to realize the dynamic adjustment of user permissions.

[0049] Another objective of this invention is to provide an intelligent dynamic permission management system for meteorological operational systems that applies the aforementioned intelligent dynamic permission management method for meteorological operational systems, comprising:

[0050] The data acquisition module is used to interact with various subsystems in the meteorological business system through interfaces, obtain user behavior, user information and meteorological resource information and feed them back to the system;

[0051] The trust value assessment module is used to calculate the initial trust value and periodic trust value of the user's current request, perform assessment tasks respectively, and dynamically adjust the user's permissions based on the assessment results;

[0052] The permission adjustment module is used to implement the function of dynamically adjusting user permissions. It dynamically adjusts user permissions based on the results of periodic trust assessments and is implemented on the improved access control model.

[0053] The entity management module is used to manage evaluation factor entities, permission entities, and role entities, and to perform add, delete, and modify operations.

[0054] The data management module is used to manage user information, meteorological resource information, and the set of trust value assessment factors, and to perform query, deletion, modification, and addition operations.

[0055] The visualization module is used to visually display user management, permission management, role management, trust value assessment factor management, interface management, user behavior detection management, and log management.

[0056] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, causing the processor to perform the steps of the intelligent permission dynamic management method for meteorological business systems.

[0057] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the intelligent permission dynamic management method for meteorological business systems.

[0058] Another objective of this invention is to provide an information data processing terminal, which is used to implement the aforementioned intelligent dynamic permission management system for meteorological business systems.

[0059] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0060] First, based on the characteristics of meteorological business systems, this invention designs and summarizes a set of factors that affect user permission assessment, and adopts an intelligent permission dynamic management assessment method based on user trust values. This method can promptly detect dangerous user behaviors, continuously monitor and assess user behavior during system use, and adjust permissions accordingly, thereby realizing intelligent permission dynamic management of meteorological business systems and ensuring the security of meteorological business systems.

[0061] The meteorological field lacks evaluation factors for permission adjustments. This invention proposes a set of trust value evaluation factors for modern meteorological operational systems, based on their security requirements and characteristics, to meet the security needs of the meteorological field. The intelligent dynamic permission management method of this invention continuously evaluates the trust behavior of users using meteorological operational systems, promptly adjusting the permissions of abnormal users. Permission adjustments are implemented based on the "usage control model for meteorological operational systems" proposed in this invention, avoiding the permission overflow problem of existing meteorological operational systems where "one-time authorization grants lifetime access," thus improving the security of meteorological operational systems.

[0062] This invention relates to a dynamic permission management method for meteorological operational systems. Based on the characteristics of meteorological operations, this invention designs and summarizes a set of trust assessment factors for meteorological operational systems and conducts periodic trust assessments of user behavior. User permissions are dynamically adjusted in a timely manner based on the assessment results, thus achieving dynamic permission management for meteorological operational systems. Finally, based on the characteristics of meteorological operations, this invention refines the usage control model and proposes a usage control model for meteorological operational systems. The results of dynamic user permission adjustments are implemented on this model, reflecting the dynamic nature of permissions. This dynamic permission management method is applicable to the security management of meteorological operational systems, ensuring the operational safety of users and improving the security of meteorological operational systems.

[0063] Secondly, the intelligent dynamic permission management method for meteorological business systems of the present invention monitors and continuously evaluates user behavior in real time through a trust value evaluation module and a permission adjustment module, and dynamically adjusts user permissions. This avoids the problems of permission overflow, slow perception of abnormal user behavior, and untimely adjustment of corresponding permissions caused by the existing system's one-time authorization and unchanged permissions during access. It can effectively improve the security of meteorological business systems.

[0064] Third, as supplementary evidence of the inventive step of the claims of this invention, it is also reflected in the following important aspects:

[0065] The technical solution of this invention fills a technological gap in the industry both domestically and internationally:

[0066] This invention is designed for meteorological operational systems and fills the gap in dynamic permission management in domestic meteorological operational systems. Attached Figure Description

[0067] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is a flowchart of the intelligent dynamic permission management method for meteorological business systems provided in this embodiment of the invention;

[0069] Figure 2 This is a schematic diagram of the set of trust value evaluation factors for meteorological business systems provided in this embodiment of the invention;

[0070] Figure 3 This is a schematic diagram of the initial trust assessment value setting provided in an embodiment of the present invention;

[0071] Figure 4 This is a schematic diagram of periodic trust assessment provided in an embodiment of the present invention;

[0072] Figure 5 This is a new model diagram for dynamic permission management in meteorological business systems provided by embodiments of the present invention;

[0073] Figure 6 This is a functional module diagram of the intelligent dynamic permission management system for meteorological business systems provided in this embodiment of the invention;

[0074] Figure 7 This is an information interaction diagram of the intelligent permission dynamic management system for meteorological business systems provided in this embodiment of the invention. Detailed Implementation

[0075] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0076] To address the problems existing in the prior art, this invention provides an intelligent dynamic permission management method, system, and terminal for meteorological business systems. The invention will be described in detail below with reference to the accompanying drawings.

[0077] like Figure 1 As shown, the intelligent dynamic permission management method for meteorological business systems provided in this embodiment of the invention includes the following steps:

[0078] S101, construct a set of trust value assessment factors, a set of roles, and a set of permissions for the meteorological business system. Users obtain roles based on their registration information and establish user history behavior profiles.

[0079] S102, When a user initiates a business request to the meteorological business system, the system assigns an initial trust value to the user's current request based on the user's role and historical behavior trust value.

[0080] S103: Continuously and periodically assess user behavior during user access and dynamically adjust user permissions based on the results of the periodic trust assessment.

[0081] As a preferred embodiment, the intelligent dynamic permission management method for meteorological business systems provided by this invention specifically includes the following steps:

[0082] Step 1: Construct a set of factors for evaluating the trust value of meteorological operational systems (see...) Figure 2 The system comprises a set of roles and a set of permissions. The factors, roles, and permission levels in these three sets are designed based on the operational needs of the meteorological business system and are adapted to its unique characteristics.

[0083] Step 2: New user registration. The system assigns roles to new users and creates user history profiles based on their registration information.

[0084] Step 3: When a user initiates an access request, the system first performs identity authentication and assigns an initial trust value to the user's current request based on their role and historical behavior trust value.

[0085] Step 4: During the user's access to the system, conduct continuous and periodic trust assessments of the user's behavior, and adjust the user's permissions based on the assessment results;

[0086] Step 5: Dynamic adjustment of permissions is implemented on the usage control model for meteorological business systems, which has been improved based on the characteristics and business needs of meteorological business systems.

[0087] In step 1 of this embodiment of the invention, based on the characteristics of the meteorological business system, the set of trust assessment factors for the meteorological business system consists of requester factors, environmental factors, and accessed resource factors, specifically including:

[0088] (1) Requester factors

[0089] 1) Meteorological Subject Roles: The role types of users requesting access to the meteorological operational system's data resources. Role types are divided into public service roles, commercial service roles, scientific and technological service roles, and operation and maintenance management roles. Public service roles refer to ordinary users, where the meteorological operational system provides meteorological information to the public. Commercial service roles refer to companies or manufacturers cooperating with the meteorological bureau, for whom the meteorological operational system provides accurate meteorological information for the production and sale of goods. Scientific and technological service roles refer to researchers in agriculture, water conservancy, and related industries who require the most precise meteorological data for scientific research. Operation and maintenance management roles refer to personnel who manage and maintain the meteorological operational system and its data resources.

[0090] 2) Permission Level: The user's permission level. Different permission levels correspond to access to different meteorological resources and are related to user roles. Users with higher permission levels also have the permissions of users with lower permission levels.

[0091] 3) Meteorological subject trust value: The user's trust value, which is the basis for dynamically adjusting user permissions.

[0092] 4) Meteorological Subject Behavior: User behavior during access to the meteorological service system is recorded in the user behavior table. Dangerous behavior is marked as 1, and normal behavior is marked as 0.

[0093] (2) Environmental factors:

[0094] 1) Environment Level: The environmental status level of the user's location when the user initiates a service request. Whether domestically or internationally, natural disasters in the user's geographical location, remote or complex geographical locations, and communication line quality will all affect the environment level assessment.

[0095] 2) Link security assessment value: The security assessment value of the path a user takes when requesting access to the meteorological service system. For example, overseas users need to pass through public networks in multiple countries, which presents more security threats, and the link security assessment value will be lower.

[0096] 3) Network status assessment value: A comprehensive assessment of the user's network, including bandwidth, network latency, network jitter, packet loss rate, etc.

[0097] 4) Resource Utilization: The resource usage of meteorological equipment accessed during user access to the meteorological service system, including CPU, GPU, memory, and storage space. An abnormally high resource utilization rate may indicate a threat.

[0098] (3) Factors related to the accessed resource:

[0099] 1) Validity period of meteorological resources: This mainly refers to the validity period of meteorological data. Different validity periods are divided into short-term valid data, medium-term short-term valid data, and long-term valid data.

[0100] 2) Meteorological resource confidentiality levels: Meteorological resources are classified into three levels based on the complexity of their encryption algorithms: public, confidential, and top secret.

[0101] 3) Meteorological Resource Trust Threshold: The trust threshold for meteorological resources is set by the system administrator. The higher the trust threshold, the more important the meteorological resource is, and the greater the access permissions required.

[0102] like Figure 3 As shown, the algorithm flow for setting the initial evaluation value of the user's current request in step 3 of the embodiment of the present invention specifically includes:

[0103] Step 3.1: When a user initiates a service request to the meteorological service system for the first time, the initial trust value for this access is evaluated based on the user's role. The maximum trust value for this role and the maximum trust value for a role one level lower than this permission level are obtained. The average of these two maximum values ​​is taken as the initial trust value for the user's access.

[0104] Step 3.2: To address user error, an initial trust value assessment is performed on this visit using the historical behavior trust values ​​recorded in the user's historical behavior profile, considering the user's trust values ​​at different time periods (long-term, medium-term, and short-term). The initial trust value T for this user visit is... H (S) The sliding window algorithm is used to calculate and obtain the historical trust values ​​of the most recent N times. The sliding window size Z L Z M Z S Z L >Z M >Z S T H(S)=αT H-L (S)+βT H-M (S)+γT H-S (S), where, α∈[0,1], β∈[0,1], γ∈[0,1], α+β+γ=1, T H-S (S) records Z each time the window slides. L The mean of each data point is calculated, and then the mean of each mean is calculated again. T H-M (S) and T H-S (S) Similarly, T is finally calculated. H (S) represents the user's initial trust value for this visit.

[0105] like Figure 4 As shown, the periodic trust assessment process in step 4 of this embodiment includes:

[0106] Step 4.1: The user initiates a business request.

[0107] Step 4.2: Determine if the user attributes and meteorological equipment attributes match. If they match, proceed to the next step; otherwise, reject the access request.

[0108] Step 4.3: Does the user meet the obligations of the access control model, i.e., the user needs to complete instructions and provide data before or during access to meteorological resources to obtain permission? If the user does not meet the obligations, feedback information will be received.

[0109] Step 4.4: Obtain the trust threshold for accessing meteorological resources. If the user's initial trust value for this access is greater than or equal to the trust threshold of the meteorological resources, the meteorological resources will issue an access consent instruction; otherwise, the user will receive feedback information.

[0110] Step 4.5: The user obtains permission to access meteorological resources.

[0111] Step 4.6: At the end of a cycle, calculate the user cycle trust value T(S), where T(S) = T1(S) = T2(S) = T3(S) = T4(S). If the IP address and geographical location remain consistent, and the environmental threat level is 0 or 1, the trust value T1(S) remains unchanged; otherwise, the trust value T1(S) decreases. User behavior is categorized into normal and dangerous behaviors. Comparing with the dangerous behavior table, if dangerous behavior occurs, the trust value T2(S) decreases. Higher resource utilization leads to a decrease in the trust value T3(S). The link security assessment value and network latency jointly determine the trust value T4(S).

[0112] Step 4.7: Trust values ​​T1(S), T2(S), T3(S), and T4(S) are used to obtain the user's current period trust value T(S) = X1T1(S) + X2T2(S) + X3T3(S) + X4T4(S), where X1, X2, X3, X4 ∈ [0,1], and X1 + X2 + X3 + X4 = 1.

[0113] Step 4.8: Return to Step 4.2 and start a new round of periodic trust assessment, where the initial trust value for this access in Step 4.4 is replaced by the trust value from the previous round of periodic assessment.

[0114] Step 4.9: The user actively issues a command to stop using meteorological resources, and the access ends.

[0115] The usage control model for meteorological operational systems provided in this invention is refined according to the characteristics of meteorological operational systems. The subject and object in the usage control model are changed to meteorological subject and meteorological object, and meteorological subject attributes and meteorological object attributes are added. This model adds a periodic trust assessment module, adding trust values ​​and trust thresholds to meteorological subjects and meteorological objects respectively. This reflects the effect of the set of trust value assessment factors of the meteorological operational system on the periodic trust assessment module, thereby dynamically adjusting user permissions.

[0116] In step S5 of this embodiment of the invention, the control model is improved based on the characteristics and operational needs of the meteorological business system. The control model is further refined according to industry characteristics, specifically including:

[0117] 1. The subject and object are refined to suit the characteristics of the meteorological operational system. The subject is changed to the meteorological subject, i.e., the user applying to access meteorological equipment. The object is the meteorological object, i.e., meteorological resources. The meteorological subject and the meteorological object not only have their own attributes, but are also assigned trust values.

[0118] 2. Use the control model to add a periodic trust assessment module to conduct trust assessments on subjects, participate in access control decisions, and maintain a state of vigilance at all times to ensure that the behavior of meteorological subjects and objects is appropriate and the permissions are reasonable, thereby ensuring the security of the meteorological business system.

[0119] 3. The set of trust value assessment factors for the meteorological business system is used in the periodic trust assessment module, and the assessment results are finally fed back to the access control system to realize the dynamic adjustment of user permissions.

[0120] like Figure 5 As shown, in step S5 of this embodiment of the invention, the usage control model for the meteorological business system is an improvement based on the usage control model, tailored to the industry characteristics of the meteorological business system. The specific improvements include:

[0121] Step 5.1: The access control model for meteorological operational systems is referred to as the MS-UCON model. The MS-UCON model is an adjustment based on the existing control model. The existing control model typically has a rather crude design of the subject and object, which cannot fully meet the security requirements of the meteorological operational system. In the MS-UCON model, both the subject and object are corrected to meteorological subjects and meteorological objects, namely, users accessing the meteorological operational system and meteorological resources. Corresponding attributes are added to both meteorological subjects and meteorological objects.

[0122] Step 5.2: The control model uses authorization, obligation, and condition extension elements to increase decision continuity and attribute variability, and monitors subject behavior in real time. However, the control model authorizes based on successful authentication, and cannot quickly identify malicious behavior. The MS-UCON model adds a periodic trust assessment module to the control model. This module monitors user behavior in real time and conducts periodic trust assessments, adding trust values ​​and trust thresholds for meteorological subjects and objects respectively, to determine whether the user can ultimately obtain access to meteorological resources.

[0123] Step 5.3: The set of trust value assessment factors for the meteorological business system is used in the periodic trust assessment module, and the assessment results are finally fed back to the access control system to realize the dynamic adjustment of user permissions.

[0124] like Figure 6 As shown in the embodiment of the present invention, the intelligent dynamic permission management system for meteorological business systems includes:

[0125] The data acquisition module allows various subsystems within the meteorological operational system to interact with the dynamic management system of permissions through interfaces, obtaining user behavior, user information, and meteorological resource information, which are then fed back to this system.

[0126] The trust value assessment module is used to calculate the initial trust value and periodic trust value for a user's current request. The initial trust value is calculated based on the user's role and historical behavior trust values, while the periodic trust value is calculated based on network performance when the user initiates the service request, the utilization rate of meteorological resources, and the user's behavior during the access period. The initial trust value is calculated only once for each service request initiated by the user, while the periodic trust value is calculated multiple times.

[0127] The permission adjustment module is used to implement the function of dynamically adjusting user permissions. It dynamically adjusts user permissions based on the results of periodic trust assessments and is implemented on an improved access control model.

[0128] The entity management module is used to manage evaluation factor entities, permission entities, and role entities, and to perform add, delete, and modify operations.

[0129] Data Management Module: This module manages data such as user information, meteorological resource information, and trust value assessment factor set, and can perform query, deletion, modification, and addition operations.

[0130] Visualization module: Provides visual representations of user management, permission management, role management, trust value assessment factor management, interface management, user behavior detection management, and log management.

[0131] The information interaction diagram of the intelligent permission dynamic management system for meteorological business systems provided in this embodiment of the invention is as follows: Figure 7 As shown, the system modules of this invention are sequentially progressive. Users obtain initial access to meteorological equipment through initial permission allocation. During access, user behavior is monitored in real time, and trust assessments are performed on user behavior at periodic intervals. Finally, the assessment results are used as the basis for permission adjustment. This is implemented on the usage control model for meteorological business systems, thereby improving the security of meteorological business systems and ensuring that the meteorological business systems can receive timely alerts and make rapid adjustments when attacked.

[0132] Example 1

[0133] For long-term users of the meteorological operational system, with a period T = 120 seconds, the most recent historical trust value N = 9 is obtained, and the short-term sliding window size Z is [not specified]. S =3, Mid-term sliding window size Z M =5, Long-term sliding window size Z L =7, α=0.25, β=0.35, γ=0.4, X1=0.2, X2=0.4, X3=0.2, X4=0.2.

[0134] Step 1: The meteorological business system obtains the role of the technology service role in Example 1. It retrieves the user's most recent nine historical trust values ​​{59, 62, 63, 60, 61, 62, 61, 63, 65} from the historical behavior profile, T. H-S (S) sliding dimension Z S =3, the average value for each iteration is {61.3, 61.7, 61.3, 61, 61.3, 62, 63}, T H-S (S) = 61.66, and similarly Z M =5 and Z L =7 can be used to derive T H-M (S) = 61.56, T H-L (S) = 61.66, T H (S)=0.25T H-L (S)+0.35T H-M (S)+0.4T H-S (S) = 61.63, the initial trust value for this access in Example 1 is 61.63.

[0135] Step 2: Example 1 initiates a service request to the automatic weather station. The time when Example 1 initiates the service request is 11:15:00, the IP address is 171.218.210.105, the geographical address is Chengdu, Sichuan Province, China, and the network transmission medium is wired network.

[0136] Step 3: In Example 1, the user's attribute is a technology service role, the applied equipment is an automatic weather station, meteorological observation data is obtained, the user attribute and meteorological equipment attribute match, and proceed to the next step.

[0137] Step 4: Example 1 provides the automatic weather station with the administrator's approval instruction, fulfilling the obligation conditions, and proceeds to the next step.

[0138] Step 5: Obtain the trust threshold of the meteorological observation data from the automatic weather station as 60; Example 1: The initial trust value of this access is 61.63, which is greater than or equal to the trust threshold of the meteorological observation data of 60, thus meeting the condition and proceeding to the next step.

[0139] Step 6: Example 1: Access the automatic weather station to obtain meteorological observation data.

[0140] Step 7: Time 11:17:00, calculate the current periodic trust value of Example 1. Based on the information obtained in Step 2. IP address 171.218.210.105, geographical address Chengdu, Sichuan Province, China, the IP address and geographical location are consistent, the environmental threat level is 0, T C1 (S) = 61.13; Example 1 initiates a service request and obtains access permission, but Example 1 repeatedly attempts to copy confidential data. Comparing this to the dangerous behavior table, this is considered dangerous behavior, and the trust value decreases. T C2 (S) = 60.13; the CPU utilization and memory usage of the automatic weather station did not show any abnormal increase, the trust value remained unchanged, and T C3 (S) = 61.13; In Example 1, the geographical location of the access was within China, the ping value was 55ms, the packet loss rate was 0, the network jitter was 60ms, and T C4 (S) = 60.63.

[0141] Step 8: Example 1 Periodic Trust Value T(S) = 0.2T1(S) + 0.4T2(S) + 0.2T3(S) + 0.2T4(S) = 60.76.

[0142] Step 9: Return to Step 3 and conduct a new round of trust assessment. The initial trust value for this visit in this cycle is 60.76, which is the cycle trust value of the previous cycle.

[0143] Step 10: Example 1: Actively initiates a command to stop using the automatic weather station, and the trust assessment ends.

[0144] Example 2

[0145] For new users of the meteorological service system, after user registration, the system assigns a commercial service role based on the registration information. The maximum trust value for a commercial service role is 50. The next lower level of the role is the public service role, whose maximum trust value is 25. The average of the two maximum values ​​is 37.5. Therefore, the initial trust value for this access in Example 2 is 37.5. Example 2 enters the periodic trust assessment module starting from step 2 of Example 1.

[0146] In summary, the implementation scheme of this invention is for dynamic permission management in meteorological operational systems. Based on the characteristics of meteorological operations, this invention designs and summarizes a set of trust assessment factors for meteorological operational systems, and periodically assesses user behavior with trust. User permissions are dynamically adjusted in a timely manner based on the assessment results, thus achieving dynamic permission management in meteorological operational systems. Finally, based on the characteristics of meteorological operations, the usage control model is refined, proposing a usage control model for meteorological operational systems. The results of dynamic adjustment of user permissions are implemented on this model, reflecting the dynamic nature of permissions. This invention's system is suitable for the security management of meteorological operational systems, ensuring the operational safety of personnel using the meteorological operational system and improving the security of the meteorological operational system.

[0147] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented using hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or using software executed by various types of processors, or using a combination of the above-described hardware circuitry and software, such as firmware.

[0148] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for intelligent dynamic permission management for meteorological operational systems, characterized in that, Includes the following steps: Step 1: Construct a set of trust value assessment factors, roles, and permissions for the meteorological business system; Step 2: New user registration. The system assigns roles to new users based on their registration information and creates a user history profile. Step 3: The user initiates an access request, the system performs identity authentication, and assigns an initial trust value to the user's current request based on the user's role and historical behavior trust value; Step 4: During the user's access to the system, conduct continuous and periodic trust assessments of the user's behavior and dynamically adjust the user's permissions based on the assessment results. Step 5: Improve the usage control model based on the characteristics and business needs of the meteorological business system, and implement dynamic adjustment of permissions on the usage control model for the meteorological business system. Step three, which assigns an initial trust value to the user for this request based on role and historical behavior trust value, includes: (1) When a user initiates a business request to the meteorological business system for the first time, the initial trust value of this access is evaluated according to the user's role. The maximum value of the role trust value and the maximum value of the role trust value one level lower than the permission level are obtained. The average of the two maximum values ​​is the user's initial trust value for this access. (2) Utilize the historical behavior trust values ​​recorded in the historical behavior profile to conduct an initial trust value assessment for this visit, and analyze the user's trust values ​​in the long term, medium term, and short term; the user's initial trust value T for this visit. H (S) The sliding window algorithm is used to calculate and obtain the historical trust values ​​of the most recent N times, with the sliding window size Z. L Z M Z S Z L >Z M >Z S T H (S)=αT H-L (S)+βT H-M (S)+γT H-S (S), α∈[0,1], β∈[0,1], γ∈[0,1], α+β+γ=1, T H-S (S) records Z each time the window slides. L The mean of each data point is calculated, and then the mean of each data point is taken again to calculate T. H (S) represents the user's initial trust value for this visit; Step four involves conducting continuous and periodic trust assessments of user behavior, including: (1) The user initiates a service request; (2) Determine whether the user attributes and meteorological equipment attributes match; if they match, proceed to step (3); otherwise, reject the access request. (3) Determine whether the user meets the obligations of the access control model. If the user does not meet the obligations, obtain feedback information. (4) Obtain the access trust threshold of meteorological resources. If the user's initial trust value for this access is greater than or equal to the meteorological resource trust threshold, the meteorological resource will issue an access consent instruction; otherwise, the user will receive feedback information. (5) Users are granted access to meteorological resources; (6) At the end of a cycle, calculate the user cycle trust value T(S), T(S)=T1(S)=T2(S)=T3(S)=T4(S); if the IP address and geographical location are consistent and the environmental threat level is 0 or 1, the trust value T1(S) remains unchanged, otherwise the trust value T1(S) decreases; user behavior is divided into normal behavior and dangerous behavior. Compare with the dangerous behavior table. If dangerous behavior occurs, the trust value T2(S) decreases; the higher the resource utilization rate, the lower the trust value T3(S); the link security assessment value and network latency jointly determine the trust value T4(S); (7) Any values ​​T1(S), T2(S), T3(S) and T4(S) obtain the user's current period trust value T(S) = X1T1(S) + X2T2(S) + X3T3(S) + X4T4(S), where X1, X2, X3, X4∈[0,1], X1+X2+X3+X4=1; (8) Return to step (2) and start a new round of periodic trust assessment, wherein the initial trust value of this access in step (4) is replaced by the previous round of periodic trust value; (9) The user actively issues a command to stop using meteorological resources, and the access ends; Step five involves improving the control model based on the characteristics and operational needs of the meteorological service system, including: (1) The access control model for the meteorological business system is the MS-UCON model. The subject and object of the MS-UCON model are corrected to meteorological subject and meteorological object. The meteorological subject is the user accessing the meteorological business system, and the meteorological object is the meteorological resource. Corresponding attributes are added to the meteorological subject and meteorological object. (2) Add a periodic trust assessment module to the control model and use the periodic trust assessment module to monitor and periodically assess the user’s behavior in real time; add trust values ​​and trust thresholds to the meteorological subject and the meteorological object respectively to determine whether the user finally obtains the right to access meteorological resources; (3) The set of factors for evaluating the trust value of the meteorological business system is used in the periodic trust evaluation module, and the evaluation results are fed back to the permission management to realize the dynamic adjustment of user permissions.

2. The intelligent dynamic permission management method for meteorological operational systems as described in claim 1, characterized in that, The factors, roles, and permission levels in the meteorological operational system trust value assessment factor set, role set, and permission set in Step One are designed based on the operational needs of the meteorological operational system and are adapted to its characteristics. Specifically, the meteorological operational system trust value assessment factor set consists of requester factors, environmental factors, and accessed resource factors, including: (1) Requester factors: 1) Meteorological Subject Roles: The types of roles that users who request access to meteorological business system data resources have. Role types are divided into public service roles, commercial service roles, scientific and technological service roles, and operation and maintenance management roles. 2) Permission Level: The user's permission level; different permission levels correspond to access to different meteorological resources, which are related to the user role. Users with higher permission levels also have the permissions of users with lower permission levels. 3) Meteorological subject trust value: The user's trust value, which serves as the basis for dynamically adjusting user permissions; 4) Meteorological subject behavior: The behavior of users during their access to the meteorological business system is recorded in the user behavior table. Dangerous behavior is marked as 1, and normal behavior is marked as 0. (2) Environmental factors: 1) Environment Level: The environmental status level of the user's region when the user initiates a business request; 2) Link security assessment value: The security assessment value of the path through which a user requests access to the meteorological business system; 3) Network status assessment value: A comprehensive assessment of the user's network, including a comprehensive assessment value of bandwidth, network latency, network jitter and packet loss rate; 4) Resource utilization: The resource usage of meteorological equipment accessed by users during their access to the meteorological business system, including CPU, GPU, memory and storage space resources. An abnormally high resource utilization rate indicates a threat. (3) Factors related to the accessed resource: 1) Validity period of meteorological resources: refers to the validity period of meteorological data. Different validity periods are divided into short-term valid data, medium-term short-term valid data, and long-term valid data. 2) Meteorological resource confidentiality levels: Meteorological resources are classified into three levels based on the complexity of the encryption algorithm: public, confidential, and top secret. 3) Meteorological resource trust threshold: The trust threshold for meteorological resources is set by the system administrator; the higher the trust threshold, the more important the meteorological resource is, and the greater the access privileges.

3. An intelligent dynamic permission management system for meteorological operational systems, applying the intelligent dynamic permission management method for meteorological operational systems as described in any one of claims 1-2, characterized in that, The intelligent dynamic access control system for meteorological operational systems includes: The data acquisition module is used to interact with the dynamic management system of permissions through interfaces by various subsystems in the meteorological business system, obtain user behavior, user information and meteorological resource information and feed them back to the system; The trust value assessment module is used to calculate the initial trust value and periodic trust value of the user's current request, perform assessment tasks respectively, and dynamically adjust the user's permissions based on the assessment results; The permission adjustment module is used to implement the function of dynamically adjusting user permissions. It dynamically adjusts user permissions based on the results of periodic trust assessments and is implemented on the improved access control model. The entity management module is used to manage evaluation factor entities, permission entities, and role entities, and to perform add, delete, and modify operations. The data management module is used to manage user information, meteorological resource information, and the set of trust value assessment factors, and to perform query, deletion, modification, and addition operations. The visualization module is used to visually display user management, permission management, role management, trust value assessment factor management, interface management, user behavior detection management, and log management.

4. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, it causes the processor to perform the steps of the intelligent dynamic permission management method for meteorological business systems as described in any one of claims 1 to 2.

5. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor performs the steps of the intelligent dynamic permission management method for a meteorological business system as described in any one of claims 1 to 2.

6. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the intelligent dynamic permission management system for meteorological business systems as described in claim 3.

Images