An integrated platform zero-trust security protection system

Abstract

The present invention discloses a zero-trust security protection system for an integrated platform, which includes: an insertion execution point, which is configured to initiate a verification request to a dynamic access control module and, based on the returned verification response, execute a release, block access request or request response operation; a dynamic access control module, which is configured to perform dynamic access control on the access request of an access subject; a data security governance module, which is configured to govern data assets in a data asset library and form data asset grading and classification identification and asset status information; a security monitoring and disposal decision module, which is configured to complete the monitoring of the integrated platform operating environment, the abnormality analysis of the dynamic access control module, and generate corresponding disposal decisions based on monitoring alarms and abnormal information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a zero-trust security protection system for an integrated platform. Background Art

[0002] With the rapid development of industrial internet technologies, traditional decentralized and independent design, manufacturing, and operations business models are transitioning to centralized, collaborative, and integrated design, manufacturing, and operations business models. This has led to the emergence of integrated design, manufacturing, and operations platforms. Leveraging technologies such as the industrial internet, big data, and artificial intelligence, these platforms build a unified network, computing power, and data resource infrastructure. By establishing a collaborative model and data delivery mechanism, these platforms break down the model and data barriers between different businesses. Leveraging microservices, these platforms create flexible, diverse, and scalable design, manufacturing, and operations service applications, ultimately achieving efficient collaboration and integration across the entire design, manufacturing, and operations business. While these platforms can significantly improve the operational efficiency and reduce costs of enterprise design, manufacturing, and operations, they also significantly increase the risks of data leakage across networks and security domains, the internal spread of viruses and Trojans, and attacks by malicious internal users. Consequently, effectively improving the security capabilities of these integrated platforms and ensuring business security is becoming increasingly urgent.

[0003] Traditional security protection methods for integrated platforms are mainly based on establishing boundary protection through authentication and authorization, firewalls, intrusion detection, and antivirus. This type of protection is difficult to deal with internal malicious users, as well as scenarios where traditional security boundaries are breached due to the collaborative communication of business, applications, users, and data within the integrated platform. In recent years, scholars have proposed zero-trust protection technology, and zero-trust technology has developed rapidly. Zero-trust technology can also be applied to the security protection of integrated platforms, providing integrated platforms with capabilities such as fine-grained permission control and continuous security monitoring. However, the existing zero-trust security protection architecture does not consider the needs of data security governance in the integrated platform scenario, lacks linkage methods with data security governance, and the linkage monitoring and disposal methods with external security protection equipment are also unclear. This results in the existing architecture's insufficient ability to deal with the security risks of the entire life cycle of integrated platform data generation, processing, transmission, sharing, storage, and destruction.

[0004] The technical problems existing in the prior art are:

[0005] 1. The existing zero-trust security protection architecture lacks data security governance, which makes it unable to adapt to scenarios where the integrated platform has large data scale, large differences in security and confidentiality requirements, cross-network and cross-domain networks, multiple data users, and dynamic data permission management.

[0006] 2. The existing zero-trust architecture lacks linkage means with data security governance, resulting in its inability to link with data security and confidentiality requirements when performing dynamic access control, security monitoring and risk management, and lacks fine-grained dynamic management and control capabilities based on data assets.

[0007] 3. The existing zero-trust architecture lacks a clear method for linking external security protection equipment data with disposal decisions. Although the existing zero-trust architecture includes means of continuous monitoring of security status, the continuous monitoring is mainly for users or applications within the platform. There is a lack of continuous monitoring of hosts, security equipment and network traffic related to the platform's operating environment, and it cannot be linked with firewalls, intrusion detection systems and identity authentication systems for disposal. This results in its lack of the ability to dynamically adapt to the platform's operating environment. Summary of the Invention

[0008] The purpose of the present invention is to overcome the problems of the existing technology and disclose a zero-trust security protection system of an integrated platform. Through the structural setting of the system of the present invention, the existing technical problems involved in the background technology are solved.

[0009] The object of the present invention is achieved through the following technical solutions:

[0010] A zero-trust security protection system for an integrated platform, the zero-trust security protection system comprising:

[0011] An insertion execution point, which is embedded in the API used by the access subject to request data assets from the data asset library in the integrated platform. The insertion execution point is configured to collect context information of the request, collect data asset information of the request response, initiate a verification request to the dynamic access control module, and execute release, block access request, or request response operations based on the returned verification response;

[0012] A dynamic access control module, wherein the dynamic access control module is configured to perform dynamic access control on an access request of an access subject;

[0013] A data security management module is configured to manage data assets in the data asset library and generate data asset classification and identification as well as asset status information;

[0014] The security monitoring and disposal decision-making module is configured to complete the monitoring of the integrated platform operating environment, the abnormal analysis of the dynamic access control module, and generate corresponding disposal decisions based on monitoring alarms and abnormal information.

[0015] According to a preferred embodiment, the API is configured to achieve full coverage of data access scenarios in the integrated platform;

[0016] The verification request is a JSON / YAML file containing the access subject ID, target data asset name and address, and time information;

[0017] The verification response is a JSON / YAML file containing access request operation information. The access request operations include: release, block, and data desensitization.

[0018] According to a preferred embodiment, the insertion execution point sends a desensitization request to the data desensitization engine of the data security governance module as needed, receives a desensitization response returned by the data desensitization engine, and inserts the desensitized data in the desensitization response into the request response and returns it to the access subject;

[0019] The desensitization request is a JSON / YAML file containing information such as the access subject ID, time, and the data to be desensitized. The desensitization response is a JSON / YAML file containing the desensitized data.

[0020] According to a preferred embodiment, the dynamic access control module includes: a trust assessment engine, a role authority library and a data identification library;

[0021] The trust assessment engine is configured to receive a verification request from the plug-in execution point, and perform a trust assessment on the request based on the received handling decision information of the event handling engine in the security monitoring and handling decision module, the role authority information of the role authority library, and the data asset identification information of the data identification library, and return a verification response containing the access request operation to the plug-in execution point;

[0022] The role authority library is configured to receive role authority information from the management configuration engine, store it, and return the required role authority information according to the request of the trust assessment engine;

[0023] The data identification library is configured to receive the data asset identification output from the data classification engine, store it, and return the required data asset identification according to the request of the information evaluation engine.

[0024] According to a preferred embodiment, the handling decision information is a JSON / YAML file containing information such as the current risk value of the platform, high-risk devices, high-risk businesses, and high-risk users;

[0025] Role permission information is a JSON / YAML file containing information such as role ID, role name, organization to which the role belongs, role permissions, and role permission scope;

[0026] Data asset identification information is a JSON / YAML file that contains information such as data ID, data name, data address, data classification and identification.

[0027] According to a preferred embodiment, the data security governance module includes a data classification engine, a data desensitization engine, and a data asset situation engine;

[0028] The data grading and classification engine is configured to scan the data assets in the data asset library, generate data identifiers corresponding to the data assets, store the data asset identifiers in the data identifier library, and transmit the data assets and data asset identifiers to the data asset situation engine;

[0029] The data asset situation engine is configured to receive data assets and data asset identifiers from the data classification and categorization engine, generate data asset situation information, and transmit the data asset situation information to the security information and event management center;

[0030] The data desensitization engine is configured to receive a data desensitization request from an instrumentation execution point, perform data desensitization, and return a result of the data desensitization to the instrumentation execution point.

[0031] According to a preferred embodiment, the data asset situation includes the total number of data asset entries, the total amount of data assets, the daily increase in data assets, the total number of data asset entries in each category, the total amount of data asset entries in each category, the total number of data asset entries at each level, and the total amount of data asset entries at each level.

[0032] According to a preferred embodiment, the data desensitization methods adopted by the data desensitization engine include: replacement desensitization, encryption desensitization, and deletion desensitization.

[0033] According to a preferred embodiment, the security monitoring and handling decision module includes an anomaly analysis engine, a monitoring and warning engine, a security information and event management engine, a management configuration engine and an event handling engine;

[0034] The anomaly analysis engine is configured to receive logs from the instrumentation execution point, perform anomaly analysis, and transmit the anomaly information obtained from the analysis to the security information and event management center;

[0035] The monitoring and early warning engine is configured to receive network traffic, host logs, security device logs, and threat intelligence information from external devices, monitor the platform's operation through fusion analysis, and generate threat alerts based on the threat information obtained through monitoring;

[0036] The security information and event management center is configured to receive monitoring alarms from the monitoring and early warning engine, abnormal information from the abnormal analysis engine, and asset status from the data asset status engine, and to perform statistics, classification, management, and status analysis on users, data assets, devices, applications, monitoring alarms, and abnormal information related to platform operation security, and generate management and disposal decisions;

[0037] The management configuration engine is configured to receive management decisions from the security information and event management center, generate management configuration adjustment policies for the system, transmit role permission information to the role permission library, and transmit desensitization rules and sensitive words to the data desensitization engine;

[0038] The event handling engine is configured to receive handling decisions from the security information and event management center, generate handling strategies, and transmit the handling strategies to the trust assessment engine, firewall, intrusion detection device, and access control module.

[0039] According to a preferred embodiment, the exception information output by the exception analysis engine includes: exception ID, exception time, verification request where the exception occurred, and exception confidence level;

[0040] The threat alert includes: threat type, threat level, threat time, threat source, and threat impact range information;

[0041] Management decisions are to dynamically adjust user role permissions, including permission adjustment information and effective time information;

[0042] The handling decision is a strategy for linking with firewalls, intrusion detection devices, and identity authentication systems, including: linked device type and linkage policy information.

[0043] The aforementioned main solution of the present invention and its various further options can be freely combined to form multiple solutions, all of which can be adopted and protected by the present invention. After understanding the solutions of the present invention, those skilled in the art will understand that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by the present invention, and these are not exhaustive here.

[0044] Beneficial effects of the present invention:

[0045] 1. This invention is an innovative practice of zero-trust architecture in integrated platform security protection, which makes up for the defect of lack of data security governance in zero-trust architecture and improves the monitoring, early warning and linkage disposal capabilities.

[0046] 2. The present invention proposes a data security governance system for the zero-trust architecture, including data classification and data desensitization, which improves the data security governance capabilities of the integrated design, manufacturing, operation and maintenance platform.

[0047] 3. The present invention proposes a method for integrating dynamic access control, security monitoring and disposal decision-making with data classification and categorization, data desensitization and other technologies, realizing the integration of zero-trust architecture and data governance technology, establishing a data-centric security protection system for the integrated design, manufacturing and operation and maintenance platform, and improving the fine-grained dynamic security management and control capabilities of the integrated platform data.

[0048] 4. The present invention establishes a method for monitoring the security of the system operating environment for a zero-trust architecture, and a method for linking with the zero-trust architecture, thereby realizing the perception and linked handling of the operating environment security by the integrated design, manufacturing, and operation and maintenance platform, and improving the security perception and automatic handling capabilities of the integrated platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic diagram of the system structure principle of the present invention. DETAILED DESCRIPTION

[0050] The following describes the embodiments of the present invention through specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0051] It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures. In addition, the present invention should point out that, in the present invention, if the specific structure, connection relationship, position relationship, power source relationship, etc. are not specifically written out, the structure, connection relationship, position relationship, power source relationship, etc. involved in the present invention are all known to those skilled in the art based on the existing technology without creative work.

[0052] Example 1

[0053] refer to Figure 1 As shown in the figure, a zero-trust security protection system for an integrated platform is shown. The data plane in the figure is the data access part within the integrated platform, and the control plane is the control part of the zero-trust security protection system. The access subjects in the data plane are users, applications, and connected devices of the integrated platform. The data asset library is the database for storing data on the integrated platform, including structured and unstructured databases. Structured databases are domestic or non-domestic databases such as Mysql and Daming, and unstructured databases are Minio databases. There are many scenarios for access subjects to access the data asset library in the integrated design, manufacturing, operation and maintenance platform, including data ferrying across physically isolated networks, data access by applications and users within the platform, and data access across enterprise entities.

[0054] Preferably, the zero-trust security protection system includes: an insertion execution point, a dynamic access control module, a data security governance module, and a security monitoring and disposal decision module.

[0055] Preferably, the plug-in execution point is embedded in the API of the access subject requesting data assets from the data asset library in a low-invasive manner. It is responsible for collecting the context information of the request, the data asset information of the request response, etc., initiating a verification request to the trust assessment engine, and performing operations such as releasing or blocking the access request or request response based on the returned verification response.

[0056] The aforementioned APIs need to fully cover all scenarios of integrated platform data access to fully ensure platform data security, such as data ferrying across physically isolated networks, data access by applications and users within the platform, and data access across enterprise entities.

[0057] Preferably, the verification request is a JSON / YAML file containing information such as the access subject ID, target data asset name and address, and time. The verification response is a JSON / YAML file containing information about the access request operation, including release, block, and data desensitization.

[0058] Furthermore, the instrumentation execution point sends a desensitization request to the data desensitization engine as needed, receives a desensitization response from the engine, and inserts the desensitized data from the desensitization response into the request response, returning it to the access subject. The desensitization request is a JSON / YAML file containing information such as the access subject ID, time, and the data to be desensitized. The desensitization response is a JSON / YAML file containing the desensitized data.

[0059] Furthermore, the insertion execution point needs to record the log of the access subject accessing the data asset library, including the log file of the access subject ID, target data asset name and address, time, operation, response data size and other information.

[0060] Preferably, the dynamic access control module is responsible for performing fine-grained dynamic access control on access requests of access subjects, and is mainly composed of a trust assessment engine, a role authority library, a data identification library, and the like.

[0061] The trust assessment engine is the core of the dynamic access control module. It is responsible for receiving verification requests from the instrumentation execution point, performing a trust assessment on the request, and returning a verification response containing the access request operation to the instrumentation execution point. To perform this trust assessment, the trust assessment engine receives disposition decision information from the event handling engine, role permission information from the role permission library, and data asset identification information from the data identification library.

[0062] Disposal decision information is a JSON / YAML file that contains information such as the current risk value of the platform, high-risk equipment, high-risk businesses, and high-risk users. Role permission information is a JSON / YAML file that contains information such as the role ID, role name, organization to which the role belongs, role permissions, and the scope of role permissions. Data asset identification information is a JSON / YAML file that contains information such as data ID, data name, data address, and data classification and classification identification. The data ID is the value obtained by calculating the data using the Simhash algorithm, MD5 algorithm, etc. Data classification identification, such as confidential, secret, commercial secret, internal, non-confidential, etc., and data classification identification, such as process, drawing, operation and maintenance, human resources, contract, etc., need to be determined based on the specific business of the integrated design, manufacturing, and operation and maintenance platform.

[0063] Furthermore, the trust assessment engine can adopt hierarchical analysis method, DS evidence theory, artificial intelligence model, etc. to obtain the risk level of the verification request according to the disposal decision information, role authority information, data asset identification information, and verification request. The risk levels are high, medium, and low, respectively. The high risk level corresponds to the blocking operation, the medium risk level corresponds to the data desensitization operation, and the low risk level corresponds to.

[0064] The role permissions library is responsible for receiving and storing role permission information from the management configuration engine and returning the required role permission information based on requests from the trust assessment engine. The role permissions library is a structured database such as MySQL that stores information such as role ID, role name, role organization, role permissions, and role permission scope.

[0065] The data identification library is responsible for receiving and storing data asset identifications output by the data classification and categorization engine and returning the required data asset identifications upon request from the information assessment engine. The data identification library is a structured database, such as MySQL, that stores information such as data IDs, data names, data addresses, and data classification and categorization identifications.

[0066] Preferably, the data security governance module is responsible for governing the data assets in the data asset library, forming clear data asset hierarchical classification identification and asset status information, mainly consisting of a data hierarchical classification engine, a data desensitizing engine, and a data asset status engine.

[0067] The data grading and classification engine is the core of the data security governance module. It is responsible for scanning data assets in the data asset library, generating data identifiers corresponding to the data assets, storing the data asset identifiers in the data identifier library, and transmitting the data assets and data asset identifiers to the data asset situation engine. The data grading and classification engine uses different methods to grade and classify structured and unstructured data. For structured data, the data grading and classification results are determined through sensitive word detection methods based on regular expression matching and string matching. For unstructured data, the data grading and classification identifiers are determined through a classification algorithm based on natural language processing combined with classification rules.

[0068] The data asset status engine receives data assets and data asset identifiers from the data classification and categorization engine, generates a data asset status report, and transmits this information to the security information and event management center. This information is generated primarily based on statistical methods. This includes the total number of data asset entries, the total number of data assets, daily additions to data assets, the total number of data asset entries per category, the total number of data asset entries per category, the total number of data asset entries per level, and the total number of data asset entries per level.

[0069] The data desensitization engine is responsible for receiving data desensitization requests from the instrumentation execution point, performing the data desensitization, and returning the desensitization results to the instrumentation execution point. Data desensitization methods include: replacement desensitization, encryption desensitization, deletion desensitization, and generalization desensitization.

[0070] Preferably, the security monitoring and disposal decision-making module is responsible for monitoring the platform operating environment, analyzing the anomalies of the dynamic access control module, and generating corresponding disposal decisions based on monitoring alarms and anomaly information. It is mainly composed of an anomaly analysis engine, a monitoring and early warning engine, a security information and event management engine, a management configuration engine, and an event disposal engine.

[0071] The anomaly analysis engine receives logs from instrumentation execution points, performs anomaly analysis, and transmits the resulting anomaly information to the Security Information and Event Management Center. Using artificial intelligence and time series analysis technologies, the anomaly analysis engine builds a model for the normal operation of the trust assessment engine and detects anomalies through pattern matching. Output includes anomaly ID, anomaly time, verification request that caused the anomaly, and anomaly confidence level.

[0072] The monitoring and early warning engine receives network traffic, host logs, security device logs, threat intelligence, and other information from external devices. By integrating and analyzing this information, it monitors platform operations and generates threat alerts based on the threat information obtained. The monitoring and early warning engine uses artificial intelligence technology to correlate and analyze network traffic, host logs, security device logs, threat intelligence, and other information to generate threat alerts. Threat alerts include information such as threat type, threat level, threat time, threat source, and threat impact range.

[0073] The Security Information and Event Management Center receives monitoring alerts from the monitoring and early warning engine, anomaly information from the anomaly analysis engine, and asset status information from the data asset status engine. It then performs statistics, classification, management, and status analysis on users, data assets, devices, applications, monitoring alerts, and anomaly information related to platform operational security, generating management and disposition decisions. Management decisions primarily involve dynamically adjusting user role permissions, including information such as permission adjustment information and expiration dates. Disposition decisions primarily involve strategies for interoperation with firewalls, intrusion detection devices, and identity authentication systems, including information such as the type of interoperable device and the interoperation strategy.

[0074] The management configuration engine receives management decisions from the security information and event management center, generates the system's management configuration adjustment strategy, transmits role permission information to the role permission library, and transmits desensitization rules, sensitive words, etc. to the data desensitization engine.

[0075] The event handling engine receives handling decisions from the security information and event management center, generates handling strategies, and transmits handling strategies to the trust assessment engine, firewall, intrusion detection equipment, access control module, etc.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A zero-trust security protection system for an integrated platform, characterized in that: The zero-trust security protection system includes: An insertion execution point, which is embedded in the API used by the access subject to request data assets from the data asset library in the integrated platform. The insertion execution point is configured to collect context information of the request, collect data asset information of the request response, initiate a verification request to the dynamic access control module, and execute release, block access request, or request response operations based on the returned verification response; A dynamic access control module, wherein the dynamic access control module is configured to perform dynamic access control on an access request of an access subject; A data security management module is configured to manage data assets in the data asset library and generate data asset classification and identification as well as asset status information; The data security governance module includes a data classification engine, a data desensitization engine, and a data asset situation engine; The data grading and classification engine is configured to scan the data assets in the data asset library, generate data identifiers corresponding to the data assets, store the data asset identifiers in the data identifier library, and transmit the data assets and data asset identifiers to the data asset situation engine; The data asset situation engine is configured to receive data assets and data asset identifiers from the data classification and categorization engine, generate data asset situation information, and transmit the data asset situation information to the security information and event management center; The data desensitization engine is configured to receive a data desensitization request from the instrumentation execution point, perform data desensitization, and return the data desensitization result to the instrumentation execution point; The security monitoring and disposal decision-making module is configured to complete the monitoring of the integrated platform operating environment, the abnormal analysis of the dynamic access control module, and generate corresponding disposal decisions based on monitoring alarms and abnormal information.

2. The zero-trust security protection system according to claim 1, wherein: The API is configured to fully cover data access scenarios in the integrated platform; The verification request is a JSON / YAML file containing the access subject ID, target data asset name and address, and time information; The verification response is a JSON / YAML file containing access request operation information. The access request operations include: release, block, and data desensitization.

3. The zero-trust security protection system according to claim 2, characterized in that: The insertion execution point sends a desensitization request to the data desensitization engine of the data security governance module as needed, receives a desensitization response returned by the data desensitization engine, and inserts the desensitized data in the desensitization response into the request response and returns it to the access subject; The desensitization request is a JSON / YAML file containing information such as the access subject ID, time, and the data to be desensitized. The desensitization response is a JSON / YAML file containing the desensitized data.

4. The zero-trust security protection system according to claim 1, wherein: The dynamic access control module includes: a trust assessment engine, a role authority library and a data identification library; The trust assessment engine is configured to receive a verification request from the plug-in execution point, and perform a trust assessment on the request based on the received handling decision information of the event handling engine in the security monitoring and handling decision module, the role authority information of the role authority library, and the data asset identification information of the data identification library, and return a verification response containing the access request operation to the plug-in execution point; The role authority library is configured to receive role authority information from the management configuration engine, store it, and return the required role authority information according to the request of the trust assessment engine; The data identification library is configured to receive the data asset identification output from the data classification engine, store it, and return the required data asset identification according to the request of the information evaluation engine.

5. The zero-trust security protection system according to claim 4, characterized in that: The disposal decision information is a JSON / YAML file containing information such as the current risk value of the platform, high-risk devices, high-risk businesses, and high-risk users; Role permission information is a JSON / YAML file containing information such as role ID, role name, organization to which the role belongs, role permissions, and role permission scope; Data asset identification information is a JSON / YAML file that contains information such as data ID, data name, data address, data classification and identification.

6. The zero-trust security protection system according to claim 1, wherein: The data asset situation includes the total number of data asset items, the total amount of data assets, the daily increase in data assets, the total number of data asset items in each category, the total amount of data asset items in each category, the total number of data asset items at each level, and the total amount of data asset items at each level.

7. The zero-trust security protection system according to claim 1, wherein: The data desensitization methods adopted by the data desensitization engine include: replacement desensitization, encryption desensitization, and deletion desensitization.

8. The zero-trust security protection system according to claim 1, wherein: The security monitoring and handling decision module includes an anomaly analysis engine, a monitoring and early warning engine, a security information and event management engine, a management configuration engine, and an event handling engine; The anomaly analysis engine is configured to receive logs from the instrumentation execution point, perform anomaly analysis, and transmit the anomaly information obtained from the analysis to the security information and event management center; The monitoring and early warning engine is configured to receive network traffic, host logs, security device logs, and threat intelligence information from external devices, monitor the platform's operation through fusion analysis, and generate threat alerts based on the threat information obtained through monitoring; The security information and event management center is configured to receive monitoring alarms from the monitoring and early warning engine, abnormal information from the abnormal analysis engine, and asset status from the data asset status engine, and to perform statistics, classification, management, and status analysis on users, data assets, devices, applications, monitoring alarms, and abnormal information related to platform operation security, and generate management and disposal decisions; The management configuration engine is configured to receive management decisions from the security information and event management center, generate management configuration adjustment policies for the system, transmit role permission information to the role permission library, and transmit desensitization rules and sensitive words to the data desensitization engine; The event handling engine is configured to receive handling decisions from the security information and event management center, generate handling strategies, and transmit the handling strategies to the trust assessment engine, firewall, intrusion detection device, and access control module.

9. The zero-trust security protection system according to claim 8, characterized in that: The exception information output by the exception analysis engine includes: exception ID, exception time, verification request where the exception occurred, and exception confidence level; The threat alert includes: threat type, threat level, threat time, threat source, and threat impact range information; Management decisions are to dynamically adjust user role permissions, including permission adjustment information and effective time information; The handling decision is a strategy for linking with firewalls, intrusion detection devices, and identity authentication systems, including: linked device type and linkage policy information.

Images