A method and system for information security management of cloud service data

Abstract

The present invention relates to the field of cloud service technology, and specifically to an information security management method and system for cloud service data. When a public cloud member passes identity authentication and logs in to a server, the terminal identification code and network parameters of the public cloud member's current login device are obtained. Then, based on the terminal identification code and network parameters, it is determined whether there are changes and anomalies in the current network environment of the public cloud member. If there are changes and anomalies, the processing authority of the public cloud member is locked within a pre-divided low-risk range. Under the condition of ensuring that the normal work of the public cloud members is not affected to the greatest extent, a protection mechanism based on authority management is set to prevent the leakage of cloud storage data caused by the leakage of account information.

Description

Technical Field

[0001] The present invention relates to the field of cloud service technology, and in particular to an information security management method and system for cloud service data. Background Art

[0002] Cloud storage is an online storage model that stores data on multiple virtual servers usually hosted by a third party rather than on a dedicated server.

[0003] Cloud storage services are generally deployed in servers, and the servers manage data. For public clouds, administrators need to manage the processing permissions of each member in the public cloud to protect data from leakage. However, if a member's account information is stolen, all data within the member's processing permissions will be leaked. Therefore, the existing simple permission management is prone to data leakage in public clouds. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method and system for information security management of cloud service data, so as to solve the problem that public clouds are prone to data leakage in the prior art.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for information security management of cloud service data of the present invention comprises the following steps:

[0007] Upon receiving an access request from a public cloud member that has passed identity authentication, obtaining a value of a target network parameter of the public cloud member at the current time point and a terminal identification code, wherein the target network parameter is a network parameter with stable characteristics in historical accesses of the public cloud member;

[0008] Determining whether the public cloud member has an access risk based on the target network parameter and the terminal identification code;

[0009] When there is no access risk, the pre-set processing authority is allocated to the public cloud member; when there is an access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing authority, and the processing authority includes access authority and operation authority.

[0010] In an embodiment of the present application, judging whether the public cloud member has access risk based on the target network parameter and the terminal identification code includes:

[0011] Comparing the value of the target network parameter with a pre-constructed network parameter range, and comparing the terminal identification code with a pre-constructed set of commonly used terminal identification codes;

[0012] When the value of the target network parameter falls within the pre-built network parameter range and the terminal identification code is consistent with a common terminal identification code in a pre-built set of common terminal identification codes, it is determined that there is no access risk to the public cloud member; otherwise, it is determined that there is an access risk to the public cloud member.

[0013] In an embodiment of the present application, the commonly used terminal identification code set is constructed by the following method:

[0014] Obtaining terminal identification codes of multiple public cloud members at multiple historical access time points, wherein the user terminal identification codes are obtained by the cloud storage server, and the historical time points are time points within a target time period before the current time point;

[0015] The frequencies of the terminal identification codes at multiple historical access time points are counted, and the N terminal identification codes with the highest frequencies are taken as common terminal identification codes, and a common terminal identification code set is constructed based on the N common terminal identification codes.

[0016] In an embodiment of the present application, the process of determining the target network parameter and the process of constructing the network parameter range include:

[0017] Obtaining values ​​of multiple network parameters of multiple public cloud members at multiple historical access time points, wherein the network parameters are obtained by a cloud storage server, and the historical time points are time points within a target time period before a current time point;

[0018] Calculate the variance S of the values ​​of various network parameters corresponding to multiple historical access time points i and the average value A i , where i is the serial number of the network parameter;

[0019] The variance S i As the stability of the network parameter i, and the variance S i The network parameter that is greater than the preset threshold is taken as the target parameter o;

[0020] Based on the variance S of the target parameter at multiple historical access time points o and the average value A o Constructing network parameter ranges Among them, α is the range adjustment parameter.

[0021] In one embodiment of the present application, the network parameters include at least an IP address, a network delay, and a number of routing nodes.

[0022] In an embodiment of the present application, the process of defining the low-risk range includes:

[0023] Get the access object records of each user in the user list at multiple historical access time points;

[0024] Statistics are collected on access object records at multiple historical access time points to obtain M objects with the highest access frequency, and the M objects with the highest access frequency are used as a high-frequency access range;

[0025] The key objects in the high-frequency access range are eliminated to obtain a low-risk range, wherein the key objects are pre-marked in the database.

[0026] In one embodiment of the present application, it also includes:

[0027] When there is an access risk for the public cloud member and the public cloud member continues to request access to a high-risk range, performing biometric verification or verification code verification on the public cloud member;

[0028] When the biometric verification or the verification code verification is passed, the pre-set processing authority is allocated to the public cloud member.

[0029] In an embodiment of the present application, the access request is obtained through a first channel, and the biometric verification or the verification code verification is performed based on a second channel.

[0030] In one embodiment of the present application, it also includes:

[0031] S1, obtaining the target network parameter value and the terminal identification code of the public cloud member at the current time point again at each target time period;

[0032] S2, judging whether the public cloud member has access risk based on the target network parameters and the terminal identification code obtained again;

[0033] S3, if the public cloud member has access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range; if the public cloud member has no access risk, return to step S1 until the public cloud member exits.

[0034] The present application also provides an information security management system for cloud service data, the system comprising:

[0035] an acquisition module, configured to, upon receiving an access request from a public cloud member that has passed identity authentication, acquire a value of a target network parameter of the public cloud member at a current time point and a terminal identification code, wherein the target network parameter is a network parameter having stable characteristics in historical accesses of the public cloud member;

[0036] A determination module, configured to determine whether the public cloud member has an access risk based on the target network parameter and the terminal identification code;

[0037] A management module is used to allocate pre-set processing permissions to the public cloud members when there is no access risk; when there is an access risk, lock the processing permissions of the public cloud members in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing permissions, and the processing permissions include access permissions and operation permissions.

[0038] The beneficial effects of the present invention are as follows: a method and system for information security management of cloud service data of the present invention obtains the terminal identification code and network parameters of the current login device of the public cloud member when the public cloud member passes the identity authentication and logs in to the server. Then, based on the terminal identification code and network parameters, it is judged whether there are changes and anomalies in the current network environment of the public cloud member. If there are changes and anomalies, the processing authority of the public cloud member is locked within a pre-divided low-risk range. Under the condition of ensuring that the normal work of the public cloud members is not affected to the greatest extent, a protection mechanism based on authority management is set to prevent the leakage of cloud storage data caused by the leakage of account information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0040] Figure 1 It is an application scenario diagram of an information security management method for cloud service data shown in one embodiment of the present application;

[0041] Figure 2 is a flow chart of a method for information security management of cloud service data shown in one embodiment of the present application;

[0042] Figure 3 This is a schematic diagram of the management process of members during login in one embodiment of the present application;

[0043] Figure 4 It is a structural diagram of an information security management system for cloud service data shown in one embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0046] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show the layers related to the present invention rather than being drawn according to the number, shape and size of the layers in actual implementation. In actual implementation, the type, quantity and proportion of each layer may be changed arbitrarily, and the layer layout may also be more complicated.

[0047] In the following description, numerous details are discussed to provide a more thorough explanation of embodiments of the present invention; however, it is apparent to one skilled in the art that embodiments of the present invention may be practiced without these specific details.

[0048] Figure 1 This is an application scenario diagram of an information security management method for cloud service data shown in an embodiment of the present application, such as Figure 1 As shown, the present application establishes a public cloud service through a server 110, and a public cloud member accesses the server 110 through a terminal device 120, thereby accessing the data of the server 110. If a public cloud member has the authority to process data, he or she can also add, delete, modify, and query the data within the authority. The authority of the public cloud member is allocated by the administrator, and the administrator sets the authority of all public cloud members through the management terminal 130.

[0049] in, Figure 1 The terminal device 120 shown can be any terminal device that supports accessing the server 110, such as a smart phone, a tablet computer, a laptop computer, or a wearable device, but is not limited thereto. Figure 1 The server 110 shown can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms, and there is no limitation here.

[0050] Figure 2 is a flow chart of a method for information security management of cloud service data shown in one embodiment of the present application, such as Figure 2 As shown: A cloud service data information security management method of this embodiment may include steps S210 to S240:

[0051] S210, upon receiving an access request from a public cloud member that has passed identity authentication, obtaining a value of a target network parameter of the public cloud member at a current time point and a terminal identification code, wherein the target network parameter is a network parameter having stable characteristics in historical accesses of the public cloud member;

[0052] The public cloud member logs in through the terminal device, enters the account information and password when logging in, and completes the identity verification. The above process is the verification process of the existing general cloud data service platform. In this application, in order to verify whether the public cloud member has access risks, the value of the target network parameter and the terminal identification code of the public cloud member are obtained at the current time point of login. In this way, it is verified whether the public cloud member has abnormalities.

[0053] The network parameters include at least IP address, network delay and number of routing nodes.

[0054] The terminal identification code can be a physical MAC or a network card MAC.

[0055] S220, determining whether the public cloud member has an access risk based on the target network parameter and the terminal identification code;

[0056] In this application, the network environment and terminal of each public cloud member when logging in are recorded in advance, so as to determine whether there are any abnormalities in the current logged-in network environment and terminal. The specific judgment steps include:

[0057] S221, comparing the value of the target network parameter with a pre-constructed network parameter range, and comparing the terminal identification code with a pre-constructed set of commonly used terminal identification codes;

[0058] S222, when the value of the target network parameter falls within the pre-built network parameter range and the terminal identification code is consistent with a common terminal identification code in a pre-built set of common terminal identification codes, it is determined that there is no access risk to the public cloud member; otherwise, it is determined that there is an access risk to the public cloud member.

[0059] Among them, the network parameter range and the set of commonly used terminal identification codes are used to record the login network environment and login terminal of public cloud members under normal circumstances. Under normal circumstances, each public cloud member will generate relatively stable target network parameters according to its own habits. For example, some members are accustomed to using laptops to connect to wireless networks, so the stability of network latency and IP addresses is poor, but the stability of the number of routing nodes is strong. Some members are accustomed to using fixed PCs to access servers, so the IP address, network latency, and number of routing nodes are relatively stable. Therefore, this application predetermines the target network parameters of each member and determines the value range of the target network parameters.

[0060] The commonly used terminal identification code is used to identify members' commonly used devices to adapt to the scenario of multi-device collaboration.

[0061] Therefore, in this application, if the terminal identification code of the public cloud member at the login time belongs to a commonly used device, and the corresponding target network parameters fall within the preset network parameter range, it means that there is no abnormality in the member's terminal and network environment, and authorization can continue normally. Otherwise, there may be risks. For example, terminal changes caused by hacking, or network parameter fluctuations caused by external intrusion on the terminal.

[0062] The network parameter range and common terminal identification code set relied on in the above process are constructed through the following process.

[0063] In an embodiment of the present application, the commonly used terminal identification code set is constructed by the following method:

[0064] (1) obtaining terminal identification codes of multiple public cloud members at multiple historical access time points, wherein the user terminal identification codes are obtained by the cloud storage server, and the historical time points are time points within a target time period before the current time point;

[0065] (2) The frequencies of the terminal identification codes at multiple historical access time points are counted, and the N terminal identification codes with the highest frequencies are taken as common terminal identification codes, and a common terminal identification code set is constructed based on the N common terminal identification codes.

[0066] This application obtains the terminal identification codes extracted by public cloud members when logging in 3-6 months before the current time, and then takes each login time point as a data point, merges all data points for statistics, obtains the login device frequency ranking corresponding to each public cloud member, extracts the top N commonly used terminal identification codes, and obtains the commonly used terminal identification code set. The commonly used terminal identification code set reflects the login device habits of public cloud members.

[0067] In one embodiment of the present application, if a public cloud member changes his device, the administrator can directly add the identification code of the new device to the common terminal identification code set to prevent the permissions from being locked during normal login.

[0068] In an embodiment of the present application, the process of determining the target network parameter and the process of constructing the network parameter range include:

[0069] (1) obtaining values ​​of multiple network parameters of multiple public cloud members at multiple historical access time points, wherein the network parameters are obtained by a cloud storage server, and the historical time points are time points within a target time period before a current time point;

[0070] (2) Calculate the variance S of the values ​​of various network parameters corresponding to multiple historical access time points i and the average value A i , where i is the serial number of the network parameter;

[0071] (3) The variance S i As the stability of the network parameter i, and the variance S i The network parameter that is greater than the preset threshold is taken as the target parameter o;

[0072] (4) Based on the variance S of the target parameter at multiple historical access time points o and the average value A o Constructing network parameter ranges Among them, α is the range adjustment parameter.

[0073] Since the usage habits of each public cloud member are not exactly the same, in order to prevent the permissions of public cloud members from being locked by mistake, this application determines the corresponding target network parameters according to the habits of each public cloud member.

[0074] Specifically, the present application calculates the variance S of the values ​​of various network parameters corresponding to multiple historical access time points. i To evaluate the stability of network parameters, if they are stable enough, they can be used as target network parameters for risk assessment.

[0075] Since the target network parameters in this application also include IP addresses, variance calculation cannot be performed directly. In this application, the IP address is mapped to geographic location coordinates by calling a third-party IP geographic location API. Then the distance between the geographic location coordinates corresponding to any two historical access time points is calculated, and the variance of multiple distances is calculated, which is used as the variance of the IP address.

[0076] This application is also based on To construct the parameter value range of the target network parameter as the screening range for whether the target network parameter is abnormal. The parameter value range can be adjusted by the range adjustment parameter α to adapt to different scenarios. For example, considering the time-varying characteristics of the network environment, the value of α can be increased during the peak period of network usage to reduce false locks caused by normal network fluctuations. The value of α can be reduced during the trough period of network usage to improve detection sensitivity.

[0077] S230, if there is no access risk, allocating a preset processing permission to the public cloud member, wherein the processing permission includes an operation permission and an access permission, and the operation permission is a permission to add, delete, modify, and query;

[0078] S240: If there is an access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing authority.

[0079] In this application, if it is determined that a public cloud member has an access risk, the access and operation of the public cloud member can be immediately prohibited. However, in order to avoid some situations where the normal work of the staff is affected by mistaken locking, this application adopts a semi-locking mechanism. That is, if it is determined that a public cloud member has an access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range. Objects in the low-risk range can still be accessed and operated normally. However, some important files that are not needed for the daily work of public cloud members will be locked. This balances not affecting the work of public cloud members and preventing data leakage. In general, a single public cloud member needs to use relatively little file data when performing normal work. Therefore, when the authority is semi-locked, the security of most file data can be guaranteed without affecting the normal work of a single public cloud member.

[0080] In an embodiment of the present application, the process of defining the low-risk range includes:

[0081] (1) Obtain access object records for each user in the user list at multiple historical access time points;

[0082] (2) Counting the access object records at multiple historical access time points to obtain M objects with the highest access frequency, and using the M objects with the highest access frequency as the high-frequency access range;

[0083] (3) Eliminate key objects in the high-frequency access range to obtain a low-risk range, wherein the key objects are pre-marked in the database.

[0084] In this application, by obtaining the access object records of each member 3-6 months before the current time and performing statistics, all the access objects required by the member for recent work are obtained as the high-frequency access range. Then, by removing some files containing key information from the high-frequency access range, a low-risk range can be obtained. The low-risk range is used as the member's daily work access range. If a member has access risks, but has been accessing the low-risk range, it can be further verified without affecting the member's work that the member may be mistakenly locked, further eliminating the risk of data leakage. Even if a member's account is hacked, resulting in an access risk, the data that can be accessed and operated is limited to the low-risk range. This application ensures data security in cloud storage services through risk identification and permission management.

[0085] In an embodiment of the present application, the present application can also eliminate the permission lock through the following process, including:

[0086] (1) when there is an access risk for the public cloud member and the public cloud member continues to request access to a high-risk range, biometric verification or verification code verification is performed on the public cloud member;

[0087] (2) When the biometric verification or the verification code verification is passed, a pre-set processing authority is allocated to the public cloud member.

[0088] In this application, if a public cloud member is determined by the system to have access risks, and at this time the public cloud member determined by the system to have access risks wants to access the locked files, it only needs to continue the identity verification once to release it, and the verification method includes biometric verification or verification code verification.

[0089] In order to prevent the hacker from cracking the verification information of the server through the original channel when the channel is hijacked, the access request is obtained through the first channel, and the biometric verification or the verification code verification is performed based on the second channel. The server will only perform the verification process when it receives the verification information from the second channel.

[0090] Figure 3 This is a schematic diagram of the management process of members during login in an embodiment of the present application. Figure 3 As shown, in one embodiment of the present application, it also includes:

[0091] S1, obtaining the target network parameter value and the terminal identification code of the public cloud member at the current time point again at each target time period;

[0092] S2, judging whether the public cloud member has access risk based on the target network parameters and the terminal identification code obtained again;

[0093] S3, if the public cloud member has access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range; if the public cloud member has no access risk, return to step S1 until the public cloud member exits.

[0094] This application not only performs risk detection when the user logs in, but also performs risk assessment every target time interval for members who log in continuously. If there are changes in the network environment and the login device during the continuous login period, it will also be judged as an access risk, thus triggering the permission locking mechanism. This ensures data security more strictly.

[0095] The information security management method of cloud service data of the present invention obtains the terminal identification code and network parameters of the current login device of the public cloud member when the public cloud member passes the identity authentication and logs in to the server. Then, based on the terminal identification code and network parameters, it is judged whether there are changes and anomalies in the current network environment of the public cloud member. If there are changes and anomalies, the processing authority of the public cloud member is locked within a pre-divided low-risk range. Under the condition of ensuring that the normal work of the public cloud members is not affected to the greatest extent, a protection mechanism based on authority management is set to prevent the leakage of cloud storage data caused by the leakage of account information.

[0096] like Figure 4 As shown, the present application also provides an information security management system for cloud service data, the system comprising:

[0097] an acquisition module, configured to, upon receiving an access request from a public cloud member that has passed identity authentication, acquire a value of a target network parameter of the public cloud member at a current time point and a terminal identification code, wherein the target network parameter is a network parameter having stable characteristics in historical accesses of the public cloud member;

[0098] A determination module, configured to determine whether the public cloud member has an access risk based on the target network parameter and the terminal identification code;

[0099] A management module is used to allocate pre-set processing permissions to the public cloud members when there is no access risk; when there is an access risk, lock the processing permissions of the public cloud members in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing permissions.

[0100] The information security management system of cloud service data of the present invention obtains the terminal identification code and network parameters of the current login device of the public cloud member when the public cloud member passes the identity authentication and logs in to the server. Then, based on the terminal identification code and network parameters, it is judged whether there are changes and anomalies in the current network environment of the public cloud member. If there are changes and anomalies, the processing authority of the public cloud member is locked within a pre-divided low-risk range. Under the condition of ensuring that the normal work of the public cloud members is not affected to the greatest extent, a protection mechanism based on authority management is set to prevent the leakage of cloud storage data caused by the leakage of account information.

[0101] Figure 5 The structure diagram of the computer system suitable for implementing the electronic device of the embodiment of the present application is shown. It should be noted that: Figure 5 The computer system 500 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0102] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 to the random access memory (RAM) 503, such as executing the method in the above embodiment. In the RAM 503, various programs and data required for system operation are also stored. The CPU 501, the ROM 502 and the RAM 503 are connected to each other through the bus 504. The input / output (I / O) interface 505 is also connected to the bus 504.

[0103] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed so that a computer program read therefrom is installed into the storage section 508 as needed.

[0104] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 509, and / or installed from a removable medium 511. When the computer program is executed by a central processing unit (CPU) 501, various functions defined in the system of the present application are executed.

[0105] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0106] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0107] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0108] Another aspect of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer, the computer executes the above method. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0109] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in each of the above embodiments.

[0110] The above embodiments are only preferred embodiments for fully illustrating the present application, and the protection scope of the present application is not limited thereto. Any equivalent substitution or change made by a person skilled in the art based on the present application is within the protection scope of the present application.

Claims

1. A method for information security management of cloud service data, characterized in that: Includes steps: Upon receiving an access request from a public cloud member that has passed identity authentication, obtaining a value of a target network parameter of the public cloud member at the current time point and a terminal identification code, wherein the target network parameter is a network parameter with stable characteristics in historical accesses of the public cloud member; Determining whether the public cloud member has an access risk based on the target network parameter and the terminal identification code; determining whether the public cloud member has an access risk based on the target network parameter and the terminal identification code, including: comparing the value of the target network parameter with a pre-constructed network parameter range, and comparing the terminal identification code with a pre-constructed set of commonly used terminal identification codes; when the value of the target network parameter falls within the pre-constructed network parameter range, and the terminal identification code is consistent with a commonly used terminal identification code in the pre-constructed set of commonly used terminal identification codes, determining that the public cloud member does not have an access risk, otherwise determining that the public cloud member has an access risk; the process of determining the target network parameter and the process of constructing the network parameter range include: obtaining values ​​of multiple network parameters of multiple public cloud members at multiple historical access time points, wherein the network parameters are obtained by a cloud storage server, and the historical access time points are time points within a target time period before the current time point; calculating the variance S of the values ​​of the multiple network parameters corresponding to the multiple historical access time points i and the average value A i , where i is the serial number of the network parameter; the variance S i As the stability of the network parameter i, and the variance S i The network parameter greater than the preset threshold is used as the target parameter o; the variance S of the target parameter at multiple historical access time points is used as the target parameter o; o and the average value A o Constructing network parameter ranges Among them, α is the range adjustment parameter; When there is no access risk, the pre-set processing authority is allocated to the public cloud member; when there is an access risk, the processing authority of the public cloud member is locked in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing authority, and the processing authority includes access authority and operation authority.

2. The information security management method of cloud service data according to claim 1, characterized in that: The commonly used terminal identification code set is constructed by the following method: Obtain terminal identification codes of multiple public cloud members at multiple historical access time points, wherein the user terminal identification code is obtained by the cloud storage server, and the historical access time points are time points within a target time period before the current time point; The frequencies of the terminal identification codes at multiple historical access time points are counted, and the N terminal identification codes with the highest frequencies are taken as common terminal identification codes, and a common terminal identification code set is constructed based on the N common terminal identification codes.

3. The information security management method of cloud service data according to claim 1, characterized in that: The network parameters include at least IP address, network delay and number of routing nodes.

4. The information security management method of cloud service data according to claim 1, characterized in that: The process of defining the low-risk area includes: Get the access object records of each user in the user list at multiple historical access time points; Statistics are collected on access object records at multiple historical access time points to obtain M objects with the highest access frequency, and the M objects with the highest access frequency are used as a high-frequency access range; The key objects in the high-frequency access range are eliminated to obtain a low-risk range, wherein the key objects are pre-marked in the database.

5. The information security management method of cloud service data according to claim 1, characterized in that: Also includes: When the access request has a risk and the public cloud member continues to request access to a high-risk range, performing biometric verification or verification code verification on the public cloud member; When the biometric verification or the verification code verification is passed, the pre-set processing authority is allocated to the public cloud member.

6. The information security management method for cloud service data according to claim 5, characterized in that: The access request is obtained through a first channel, and the biometric verification or the verification code verification is performed based on a second channel.

7. The information security management method of cloud service data according to claim 1, characterized in that: Also includes: S1, obtaining the target network parameter value and the terminal identification code of the public cloud member at the current time point again at each target time period; S2, judging whether the public cloud member has access risk based on the target network parameters and the terminal identification code obtained again; S3, when the public cloud member has access risk, locking the processing authority of the public cloud member into a pre-defined low-risk range; When there is no access risk for the public cloud member, the process returns to step S1 until the public cloud member exits.

8. An information security management system for cloud service data, characterized in that: The system comprises: an acquisition module, configured to, upon receiving an access request from a public cloud member that has passed identity authentication, acquire a value of a target network parameter of the public cloud member at a current time point and a terminal identification code, wherein the target network parameter is a network parameter having stable characteristics in historical accesses of the public cloud member; A judgment module, used to judge whether the public cloud member has access risk based on the target network parameter and the terminal identification code; judging whether the public cloud member has access risk based on the target network parameter and the terminal identification code, including: comparing the value of the target network parameter with a pre-constructed network parameter range, and comparing the terminal identification code with a pre-constructed set of commonly used terminal identification codes; when the value of the target network parameter falls within the pre-constructed network parameter range, and the terminal identification code is consistent with a commonly used terminal identification code in the pre-constructed set of commonly used terminal identification codes, judging that the public cloud member does not have access risk, otherwise judging that the public cloud member has access risk; the process of determining the target network parameter and the process of constructing the network parameter range include: obtaining values ​​of multiple network parameters of multiple public cloud members at multiple historical access time points, wherein the network parameters are obtained by a cloud storage server, and the historical access time points are time points within a target time period before the current time point; calculating the variance S of the values ​​of multiple network parameters corresponding to multiple historical access time points i and the average value A i , where i is the serial number of the network parameter; the variance S i As the stability of the network parameter i, and the variance S i The network parameter greater than the preset threshold is used as the target parameter o; the variance S of the target parameter at multiple historical access time points is used as the target parameter o; o and the average value A o Constructing network parameter ranges Among them, α is the range adjustment parameter; A management module is used to allocate pre-set processing permissions to the public cloud members when there is no access risk; when there is an access risk, lock the processing permissions of the public cloud members in a pre-defined low-risk range, wherein the low-risk range is included in the range corresponding to the processing permissions, and the processing permissions include access permissions and operation permissions.

Images