A cross-network data access control method based on dynamic rule strategy

Abstract

The application discloses a cross-network data access control method based on a dynamic rule strategy, relates to the technical field of data security, and comprises the following steps: S1, obtaining effective information that can support user trust evaluation; S2, obtaining a current access information matrix; S3, obtaining a trust level, a risk evaluation value and a risk factor; S4, obtaining a quantized trust level and a quantized risk factor; S5, obtaining a matching result; S6, judging whether the latest request data meets the trust requirement according to the matching result, if yes, entering the next step; otherwise, performing a higher-level authentication operation on the request user and blocking the current behavior permission; and S7, dynamically generating a behavior authorization code that allows the request user to access, obtaining the latest request processing data after the request user succeeds in the current access and returning to step S1. The method can solve the problems of the access control strategy adopted by the existing data desensitization technology and the data sensitive security problems existing in cross-network big data sharing in enterprises.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a cross-network data access control method based on dynamic rule strategy. BACKGROUND

[0002] At present, the deficiencies of the access control strategy adopted by the existing data desensitization technology and the data sensitive security problems existing in the cross-network big data sharing in enterprises are still the problems concerned in the field of data security technology.

[0003] For example, the patent application with the publication number "CN113852592A" and the name "Big data security operation and maintenance control method and system based on dynamic access control strategy" disclosed on December 28, 2021, provides a big data security operation and maintenance control method and system based on dynamic access control strategy, wherein the method comprises: receiving an access request for a big data platform from a user; in response to the received access request, matching an existing fixed access control strategy, and giving a fixed strategy disposal result; in response to the fixed strategy disposal result, performing dynamic access control strategy disposal on the access request, and giving a dynamic strategy disposal result; and according to the dynamic strategy disposal result, releasing or blocking the access request.

[0004] However, the role-based access control (RBAC) of the control method has a fundamental defect in managing user identity and access rights, which makes the system heavy, dependent on manual input, and needs to be maintained continuously. In addition, the role-based access control may cause problems such as role explosion, which may lead to security vulnerabilities. The reason is that when the enterprise expands, a user may be assigned to multiple roles, and if the user's working environment changes, the role will still remain in the original place. In addition, the allocation of roles needs to be planned, defined and allocated manually, which limits the scalability and dynamics of the deployment of a secure data environment, and cannot achieve real-time and timely response.

[0005] In addition, the existing binary access control strategy cannot meet the multi-business demand of data in cross-network in real time, and the inflexible problem caused by the fixed nature of human intervention in this strategy becomes an important obstacle to real-time data security sharing in key business scenarios. SUMMARY

[0006] The purpose of the present application is to provide a cross-network data access control method based on dynamic rule strategy to solve the deficiencies of the access control strategy adopted by the existing data desensitization technology and the data sensitive security problems existing in the cross-network big data sharing in enterprises.

[0007] The present application is realized by the following technical solutions:

[0008] A cross-network data access control method based on dynamic rule policies includes the following steps:

[0009] S1. Obtain valid information that can support user trust assessment;

[0010] S2. Perform preprocessing operations on the valid information in step S1 to obtain the current access information matrix;

[0011] S3. Call the current access matrix from step S2, and perform trust level assessment and risk assessment on the current access matrix to obtain the trust level, risk assessment value and risk factor.

[0012] S4. Quantify the trust level and the risk factor to obtain the quantified trust level and the quantified risk factor;

[0013] S5. Perform rule matching on the quantified trust level, quantified risk factor and request requirements to obtain the matching result;

[0014] S6. Determine whether the latest requested data meets the credibility requirements based on the matching results. If yes, proceed to step S7; otherwise, perform a higher level of authentication on the requesting user and block the current behavior permission.

[0015] S7. Dynamically generate an authorization code that allows the requesting user to access the service, obtain the latest request processing data after the requesting user has successfully accessed the service, and return to step S1.

[0016] Furthermore, in step S1, the valid information that can support user trust assessment includes: basic personal information of the user requesting access, network access information, and request operation information.

[0017] Furthermore, the user's basic personal information includes username, unique user ID, department, and job title; the network access information includes: requested network status, requested location, and current network security level.

[0018] Furthermore, the preprocessing operation in step S2 includes: establishing an information matrix with the requester and the requested party access relationship as rows and the corresponding access sub-network as columns.

[0019] Furthermore, in step S3, the risk assessment value is denoted as riskValue, and the method for obtaining the risk assessment value is as follows:

[0020]

[0021]

[0022] Where, weight represents the risk attribute, riskIssue represents the request operation information, n represents the number of request actions, and i represents the variable, i = 1, ..., n.

[0023] Furthermore, the weight of the risk attribute is determined by collecting behavioral trust support and the current system's tolerance threshold for users' cross-network access and risk prediction acceptance.

[0024] Furthermore, in step S3, the risk factor is denoted as TV, and the method for obtaining the risk factor is as follows:

[0025]

[0026] Among them, TV tj T represents the risk factor for the i-th behavior. i T represents the risk assessment value of the i-th behavior. j This represents the value corresponding to the j-th behavior in the business risk threshold table.

[0027] Furthermore, in step S5, the method for obtaining the matching result includes the following steps:

[0028] S51: The quantified risk factors obtained from the previous access request are labeled with the corresponding user's trust level to obtain the user's trust score.

[0029] S52: Add the user trust level as a column to the current access matrix to form the rule model NRTP.

[0030] Wherein, N describes the sub-network domain, R describes the relationship type between the requester and the requested data resource, T describes the trust level column, P describes the access authorization behavior, and NRTP describes the data association information that is allowed between different sub-networks, and determines and generates an access control matrix for subsequent systems to control permissions;

[0031] S53: Perform rule matching between the quantified trust level, quantified risk factor, and request requirements and the access control matrix generated by the rule model NRTP to obtain the matching result.

[0032] Furthermore, in step S52, if new business requirements exist, the rule model will dynamically add sub-network domains, add new topics and information relationship tables, and update the rule access control policy model NRTP to generate a new access control matrix, which will facilitate the control of user permissions in the future.

[0033] Furthermore, in step S6, if the identity authentication is successful, the value in column P corresponding to the trust level is encoded into a virtual behavior code identifier through a hash value, and injected into the corresponding user account, network environment, and network information corresponding to the accessed resource. The behavior is then checked, and if the match is incorrect, the behavior authorization is invalidated and authentication needs to be requested again.

[0034] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0035] I. This invention can mitigate the security vulnerabilities such as role explosion that exist in Role-Based Access Control (RBAC) systems.

[0036] Second, this invention proposes to combine risk assessment algorithms to calculate the trust level of the access domain and the user making the access request. If it is found that the requester is engaging in potentially dangerous behavior, timely feedback is provided, and the user is subjected to in-depth authentication operations to increase the risk factor and dynamically adjust the user's behavior permission trust level to prevent possible sensitive data threats.

[0037] Third, this invention can conduct risk assessments on data information and the data acquisition parties in different network scenarios, with different business requirements and different levels. Based on the assessment results, it dynamically injects access control policies with access authorization codes for users. While dealing with complex and multi-source access requests, it controls the user's behavior at different stages or in different scenarios, so as to solve the shortcomings of the access control policies adopted by existing data anonymization technologies and the data sensitivity and security issues in cross-network big data sharing in enterprises. Attached Figure Description

[0038] Figure 1 This is a flowchart of a cross-network data access control method based on dynamic rule policies.

[0039] Figure 2 This is a schematic diagram of a cross-network data access control method based on dynamic rule-based strategies. Detailed Implementation

[0040] To facilitate public understanding of this technical solution, the present invention will be further described in detail below with reference to embodiments, but the implementation of the present invention is not limited thereto.

[0041] Example 1

[0042] This embodiment uses a cross-network data access control method based on dynamic rule policies as an example to further illustrate the solution, which relates to the field of data security technology. (See reference...) Figure 1 , Figure 2 As shown, the control method specifically includes the following steps:

[0043] S1: Obtain valid information that can support user trust assessment.

[0044] Specifically, valid information that can support user trust assessment includes: basic personal information of the user requesting access, information about the network to which the user belongs, and information about the request operation.

[0045] The user's basic personal information includes username, unique user ID number, department, and job title;

[0046] The network information to which the access belongs includes: the requested network status, the requested location, and the current network security level.

[0047] In addition, other information can be added sequentially according to business needs, such as valid information obtained using network traffic capture tools, intrusion detection tools, etc.

[0048] S2: Preprocess the valid information that supports user trust assessment in step S1 to obtain the current access information matrix.

[0049] The preprocessing operations here include: building an information matrix with the requester and the requested party access relationship as rows and the corresponding access sub-network as columns.

[0050] S3: Call the current access matrix and perform trust level assessment and risk assessment on the current access matrix to obtain the trust level, risk assessment value and risk factor.

[0051] The specific operating method is as follows:

[0052] If multiple requests from the same user are obtained, the risk value of each relevant part is accumulated.

[0053] In this embodiment, the evaluation quantification method involves quantifying the risk attributes (weights) of the user's request network environment and request acquisition behavior (riskIssue). The risk evaluation value (riskValue) is:

[0054]

[0055] Where, weight represents the risk attribute and riskIssue represents the request operation information, n represents the number of requests to obtain actions, and i represents a variable, starting from 1 to n.

[0056] The weight of risk attributes is objectively determined by collecting behavioral trust data and considering the current system's tolerance threshold for users' cross-network access and risk assessment acceptance.

[0057] The risk assessment value is compared with the values ​​in the business risk threshold table (the threshold table is a quantitative table designed by the organization based on the importance of data in the system; different businesses and users with different roles correspond to different access risk levels). This involves normalizing and quantifying the n calculated trust level assessment values ​​to obtain the risk factor TV used to determine the degree of trust in the behavior. The risk factor TV is:

[0058]

[0059] Among them, TV tj T represents the risk factor for the i-th behavior. i T represents the risk assessment value of the i-th behavior. j This represents the value corresponding to the j-th behavior in the business risk threshold table.

[0060] S4: Quantify the trust level and the risk factor to obtain the quantified trust level and the quantified risk factor.

[0061] S5: Perform rule matching on the quantified trust level, quantified risk factor, and request requirements to obtain the matching result.

[0062] The specific operating method is as follows:

[0063] S51: The quantified risk factors obtained from the previous access request are labeled with the corresponding user's trust level to obtain the user's trust score.

[0064] S52: Add the user trust level as a column to the current access matrix to form the rule model NRTP, where: N describes the sub-network domain, R describes the relationship type between the requester and the requested data resource, T describes the trust level column, and P describes the access authorization behavior.

[0065] The NRTP describes the data association information that is allowed between different sub-networks, and determines and generates an access control matrix for subsequent systems to control permissions;

[0066] If new business needs arise, the rule model will dynamically add sub-network domains (Net), add new topics and information relationship tables, and update the rule access control policy model NRTP to generate a new access control matrix, which will facilitate the control of user permissions in the future.

[0067] S53: Perform rule matching between the quantified trust level, quantified risk factor, and request requirements and the access control matrix generated by the rule model NRTP to obtain the matching result.

[0068] S6: Based on the matching result of step S5, determine whether the latest request data meets the credibility requirements. If yes, proceed to step S7; otherwise, perform a higher level of authentication operation on the requesting user and block the current behavior permission.

[0069] If authentication is successful, the value in column P corresponding to the trust level is encoded into a virtual behavior code identifier using a hash value and injected into the corresponding user account, network environment, and network information of the accessed resource. Behavior verification is performed in the form of a "token." If the token does not match, the behavior authorization is invalid, and authentication must be requested again. Here, the "token" is the behavior authorization code.

[0070] S7: Dynamically generate an authorization code that allows the requesting user to access the service, obtain the latest request processing data after the requesting user has successfully accessed the service, and return to step S1.

[0071] This embodiment proposes a method that combines risk assessment algorithms to calculate the trust level of the access domain and the user making the access request. If the calculated requester is found to be engaging in potentially dangerous behavior, timely feedback is provided, and the user undergoes in-depth authentication to increase the risk factor and dynamically adjust the user's behavioral permission trust level, thereby preventing potential threats to sensitive data. Furthermore, this control method can conduct risk assessments for different network scenarios, different business needs, different levels of data information, and different data acquisition parties. Based on the assessment results, it dynamically injects access control policies with access authorization codes into the user, handling complex and multi-source access requests while controlling the user's behavior at different stages or in different scenarios.

[0072] Example 2

[0073] This embodiment uses an implementation scenario as an example to further illustrate the solution.

[0074] Roles: Access requester (user D with role W in network A), accessed resource (data L in network B), access requester (user D with role X in network C).

[0075] A cross-network data access control method based on dynamic rule policies includes the following steps:

[0076] (1) User D, who has complete basic information in network A, logs into the system. The access permissions granted by role W are invalid. A request needs to be sent to obtain access permissions for operation resource L.

[0077] (2) The NRTP model receives a request to obtain the basic information of the network to which user D belongs, the basic information of the network of the accessed party B, and the latest rule matrix table in NRTP.

[0078] (3) Based on the basic information already obtained, the rule model performs a trust level assessment. After the assessment, the risk factor TV = 2 and the trust value T > trust threshold of network user D are obtained. Then, the behavior request is judged to be high security and behavior permission can be granted.

[0079] (4) Security assessment of identity operation: The model checks the relationship table based on the user account. If it exists, it matches the behavior in the two-dimensional authorization matrix table information, binds the authorization behavior code to the user and the accessed network B as the token for this request operation, and returns the identity authentication and authorization success information to the user D.

[0080] (5) User D receives successful authentication feedback and can perform data operations.

[0081] (6) User D, who has complete basic information in network C, logs into the system. The access permissions granted by roles W and X are invalid. A request needs to be sent to obtain access permissions for operating resource L.

[0082] (7) After processing by the rule model, it was found that the C network does not match the rule table and is displayed as not existing.

[0083] (8) The NRTP model preprocesses the basic information of the C network and the X role user D in the C network. If the C network user is allowed to access the B network data according to the cross-domain access permission table set by the organization, the trust level assessment and quantification are carried out to determine the risk brought by the user's access and update the rule model.

[0084] (9) Trust assessment is successful and it is calculated that it is a secure access. Inject virtual behavior permission code into user D of role X in network C to allow access to data L.

[0085] (10) Operation completed.

[0086] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A cross-network data access control method based on dynamic rule-based strategies, characterized in that, Includes the following steps: S1. Obtain valid information that can support user trust assessment; S2. Perform preprocessing operations on the valid information in step S1 to obtain the current access information matrix; Preprocessing operations include: establishing an information matrix with the requester and the requested party access relationship as rows and the corresponding access sub-network as columns; S3. Call the current access matrix from step S2, and perform trust level assessment and risk assessment on the current access matrix to obtain the trust level, risk assessment value and risk factor. The risk assessment value is denoted as The method for obtaining the risk assessment value is as follows: ， ， in, weight Indicates risk attributes, riskIssue This indicates a request for operation information. n Indicates the number of actions requested. i Represents variables, i =1, ..., n ; The risk attributes weight The percentage is determined by collecting behavioral trust data and the current system's tolerance threshold and risk assessment acceptance for users' cross-network access. The risk factor is denoted as TV The method for obtaining risk factors is as follows: ， in, Indicates the first i Risk factors for this behavior Indicates the first i Risk assessment value of this behavior Indicates the first j The corresponding values ​​for this type of behavior in the business risk threshold table; S4. Quantify the trust level and the risk factor to obtain the quantified trust level and the quantified risk factor; S5. Perform rule matching on the quantified trust level, quantified risk factor and request requirements to obtain the matching result; The method for obtaining the matching results in this step includes the following steps: S51: The quantified risk factors obtained from the previous access request are labeled with the corresponding user's trust level to obtain the user's trust score. S52: Add the user trust level as a column to the current access matrix to form the rule model NRTP. Wherein, N describes the sub-network domain, R describes the relationship type between the requester and the requested data resource, T describes the trust level column, P describes the access authorization behavior, and NRTP describes the data association information that is allowed between different sub-networks, and determines and generates an access control matrix for subsequent systems to control permissions; S53: Perform rule matching between the quantified trust level, quantified risk factor and request requirements and the access control matrix generated by the rule model NRTP to obtain the matching result; S6. Determine whether the latest requested data meets the credibility requirements based on the matching results. If yes, proceed to step S7; otherwise, perform a higher level of authentication on the requesting user and block the current behavior permission. S7. Dynamically generate an authorization code that allows the requesting user to access the service. The authorization code is encoded into a virtual behavior code identifier using a hash value. This identifier is then injected into the user's account, network environment, and network information corresponding to the accessed resource for behavior verification. The latest request processing data after the requesting user's current successful access is obtained, and the process is returned to step S1.

2. The cross-network data access control method based on dynamic rule-based strategy according to claim 1, characterized in that: In step S1, the valid information that can support user trust assessment includes: basic personal information of the user requesting access, network access information, and request operation information.

3. The cross-network data access control method based on dynamic rule-based strategy according to claim 2, characterized in that: The user's basic personal information includes username, unique user ID number, department, and job title; The network information to which the access belongs includes: the requested network status, the requested location, and the current network security level.

4. The cross-network data access control method based on dynamic rule-based strategy according to claim 3, characterized in that, In step S52, if new business requirements exist, the rule model will dynamically add sub-network domains, add new topics and information relationship tables, and update the rule access control policy model NRTP to generate a new access control matrix, which will facilitate the control of user permissions in the future.

Images