A 3D digital asset security supervision system and method based on blockchain

Abstract

The present invention relates to the field of digital asset security supervision, and specifically to a blockchain-based 3D digital asset security supervision system and method, comprising a first asset space marking module, an access policy implementation module, an access record set building module, an access index analysis module and a risk processing module; the first asset space marking module is used to analyze, based on behavioral data, the existence of an asset space corresponding to a risk value greater than or equal to a risk value threshold of a 3D digital asset, and mark it as the first asset space; the access policy implementation module is used to implement an access policy based on a zero-trust security model on the first asset space; the access record set building module is used to obtain the zero-trust security model records of all access records based on the first asset space by users other than the asset owner, and construct an access record set; the access index analysis module is used to identify the access index of each user based on the first asset space; the risk processing module performs risk processing on risky users and their permissions.

Description

Technical Field

[0001] The present invention relates to the technical field of digital asset security supervision, and specifically to a 3D digital asset security supervision system and method based on blockchain. Background Art

[0002] With the development of informatization over the years, especially the emergence of various clouds, enterprises have gradually accumulated and enriched data while enjoying convenient services. At the same time, various industries have carried out data governance, and the quality of data has gradually improved; these are the foundations for the development of the digital economy. Some data need to be circulated, some data do not need to be circulated, some data need to protect their value, and some data are open and free to use. We define data that needs to be circulated and needs to protect its value as digital assets. In order to allow all participants in the digital economy to circulate data assets with confidence, thereby effectively promoting the development of the digital economy, it is necessary to provide digital assets with security protection technology to protect their circulation value. Different from ordinary digital assets, 3D digital assets have diversified asset users in terms of data generation and data operation. Diversification will inevitably bring about a high degree of security risks. Therefore, how to apply effective security protection measures to improve the security of digital assets is worth studying, and how to digitally analyze the security trends of asset space in the case of multi-terminal use to achieve dynamic monitoring is still a problem that needs to be solved. Summary of the invention

[0003] The purpose of the present invention is to provide a blockchain-based 3D digital asset security supervision system and method to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a 3D digital asset security supervision method based on blockchain, comprising the following analysis steps:

[0005] Step S100: Acquire all behavior data of the asset owner for constructing a 3D digital asset record, the behavior data including asset identification, asset space and asset authority; analyze based on the behavior data that the 3D digital asset has an asset space corresponding to a risk value greater than or equal to a risk value threshold, and mark it as a first asset space;

[0006] Step S200: Implementing an access policy based on a zero-trust security model on the first asset space, and obtaining all access records of users other than the asset owner based on the first asset space in the zero-trust security model records within a monitoring period, and constructing an access record set;

[0007] Step S300: Based on the access record set, analyzing the access index of each user based on the first asset space;

[0008] Step S400: Extract users whose access index is less than the average access index as target users, estimate the change rate of the access index corresponding to the target users based on the access rights, screen the risk users and corresponding permissions of the zero-trust security model applied to the first asset space according to the change rate; and perform risk processing on the risk users and their permissions.

[0009] Furthermore, step S100 includes the following specific steps:

[0010] Step S110: Asset identification refers to the identification and attributes set for the 3D digital asset subject; asset space refers to the data space where all historical digital assets are stored; asset authority refers to the establishment of corresponding operational authority and authority owner for each digital asset subject under each identification;

[0011] Step S120: The asset space includes several data spaces, and the sizes of the data spaces are different. The number K of attribute types recorded in each data space and the size value R of the data space are obtained, using the formula:

[0012]

[0013] Calculate the risk value y1 corresponding to each data space, where L represents the number of permission owners that can be set for one type of operable permission in each data space, m represents the number of operable permission types contained in the same data space; J represents the number of other data spaces where the permission owners in the same data space have corresponding operable permissions, and n represents the number of permission owners contained in the same data space; α, β, and γ represent the reference coefficients of the corresponding items; K / R represents the number of digital asset attribute types that can be accommodated under the unit data space size; the more types that are accommodated, the more data affected by the assets located when data risks occur, and the greater the risk;

[0014] Step S130: Obtain security events with abnormal responses in historical records, where abnormal responses refer to response records generated when 3D digital assets are leaked or attacked; extract the data space corresponding to the security event record and L, J, K, R, n and m corresponding to the data space, and calculate the response risk values ​​of the data spaces corresponding to all security events; when the number of records in the data space where the security event occurs is not 1, mark the data space as the first data space, and calculate the average value of the response risk value corresponding to the first data space as the risk representative value of the first data space; extract the risk representative value y0 of each data space, and select the minimum risk representative value min(y0) as the risk value threshold.

[0015] Furthermore, constructing the access record set includes the following specific steps:

[0016] Step S210: Mark users other than asset owners as asset users, take each asset user as a search item, traverse the first asset space to locate all access records of asset users, the access records include access address, access rights and verification method; and construct the minimum permission set Z based on asset users. The access address refers to the address information for accessing the first asset space record. i Indicates the i-th access address where the asset user has a record, f ei Indicates the verification method required by the corresponding asset user under the i-th access address, g fei Indicates the access rights after completing the verification method required by the corresponding asset user under the i-th access address;

[0017] Step S220: Based on the minimum permission set of each asset user, obtain the operation behavior data recorded after the access permission is granted to the corresponding access address, the operation behavior data includes security behavior data and abnormal behavior data; and record it as the access record set H, where x 1i represents the security behavior data of the i-th access address record, x 2i Represents the abnormal behavior data of the i-th access address record;

[0018] Further, step S300 includes the following steps:

[0019] Step S310: Mark the newly added operation behavior data x0 of each access record set by the asset user during the monitoring period, and traverse all access record sets stored by the same asset user. And x0∈{x 1i}, extract the operation behavior data x0 corresponding to the access address e i Same, f ei or fei Different second asset users, the second asset user refers to the asset user different from the operation behavior data x0, and the number of second asset users can be one or more; obtain the access record set of the second asset user, when x0 satisfies And x0∈{x 1i}When the corresponding access record set number V1 is greater than the average set number, the output operation behavior data x0 is safe behavior data;

[0020] Judging the same operation behavior data based on users with different access rights at the same address can effectively cover the diversity of executable operations based on the same address. If data under different types of permissions are all judged as safe behavior data, it means that the risk coefficient of the operation behavior data is low, and the adaptability and permissible operability are high; on the contrary, if there is abnormal behavior data, it means that the risk coefficient of the data is high, reflecting security issues from many aspects. For other types of data that do not meet the above two judgment methods, the significance of setting it as pending data is that the risk is lower than that of abnormal behavior data but higher than that of safe behavior data;

[0021] Step S320: When And x0∈{x 2i}, extract the second asset user record x0 to satisfy And x0∈{x 2i} The corresponding access record set number V2, when V2 is greater than the average set number, the output operation behavior data x0 is abnormal behavior data;

[0022] Step S330: Based on step S310 and step S320, when the operation behavior data x0 has all other data relationships with the access record set except for the safe behavior data and abnormal behavior data determination methods, the operation behavior data x0 is output as pending data;

[0023] Step S340: Obtain the number of records A1 of safe behavior data and the number of records B1 of abnormal behavior data in the historical access records of each asset user, as well as the number of times A2 of newly added operation behavior data determined as safe behavior data, the number of times B2 of newly added operation behavior data determined as abnormal behavior data, and the number of times C1 of pending data; using the formula:

[0024]

[0025] An access index W of the asset user based on the first asset space is calculated.

[0026] The larger the access index is, the safer the asset user's access to the asset space is.

[0027] Further, step S400 includes the following:

[0028] Step S410: Obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length h of the adjacent monitoring period with the same total number of newly added data based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be examined W1; use the formula:

[0029] Z=(W1-W) / h

[0030] Calculate the change rate Z of the target user's access index based on the access rights;

[0031] Step S420: When Z is less than 0, the corresponding target user is screened as a risk user, and the risk user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risk user as an asset user are extracted for early warning;

[0032] Step S430: When Z is greater than or equal to 0 and Z is greater than the change rate threshold, the target user is output as a safe user; when Z is greater than or equal to 0 and Z is less than or equal to the change rate threshold, extract the next adjacent monitoring period length that is the same as the total number of new additions and calculate the access index change rate corresponding to the next monitoring period, return to step S420 to determine the size relationship of Z, until a risky user or a safe user is output and the change rate monitoring is stopped.

[0033] Analyzing the change rate can effectively understand the impact of risky behaviors of asset users when operating digital assets on the security of asset space access, make trend judgments based on the overall trajectory of digital assets for the same user, eliminate potential exposure points by upgrading or deleting permissions, and effectively improve the security of the asset space.

[0034] A 3D digital asset security supervision system based on blockchain, comprising a first asset space marking module, an access policy implementation module, an access record set building module, an access index analysis module and a risk processing module;

[0035] The first asset space marking module is used to analyze the 3D digital assets based on the behavior data and find that the risk value of the 3D digital assets is greater than or equal to the risk value threshold and the asset space is marked as the first asset space;

[0036] The access policy enforcement module is used to enforce an access policy based on a zero-trust security model on the first asset space;

[0037] The access record set building module is used to obtain all access records of users other than the asset owner based on the first asset space in the zero-trust security model, and build an access record set;

[0038] The access index analysis module is used to analyze the access index of each user based on the first asset space;

[0039] The risk processing module is used to screen risky users and corresponding permissions of the zero-trust security model applied in the first asset space based on the change rate; and to perform risk processing on risky users and their permissions.

[0040] Further, the first asset space marking module includes an asset identification generation unit, a risk value calculation unit and a risk value threshold output unit;

[0041] The asset identification generation unit is used to set the identification and attributes of the 3D digital asset subject;

[0042] The risk value calculation unit is used to obtain the number of attribute types contained in the 3D digital assets recorded in each data space and the size value of the data space, and calculate the risk value;

[0043] The risk value threshold output unit is used to obtain security events with abnormal responses in historical records and calculate the response risk values ​​of the data spaces corresponding to all security events; when the number of records in the data space where the security event occurred is not 1, the data space is marked as the first data space, and the average value of the response risk value corresponding to the first data space is calculated as the risk representative value of the first data space; the risk representative value of each data space is extracted, and the minimum risk representative value is selected as the risk value threshold.

[0044] Further, the access index analysis module includes a newly added data identification unit and an access index calculation unit;

[0045] The newly added data identification unit is used to identify whether the newly added operation behavior data of the asset user based on each access record set during the monitoring period is safe behavior data, abnormal behavior data or pending data;

[0046] The access index calculation unit is used to calculate the access index based on the number of times of the three data records.

[0047] Further, the risk processing module includes an access index calculation unit to be examined, a change rate analysis unit, and a user and authority processing unit;

[0048] The access index calculation unit to be investigated is used to obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length of the adjacent monitoring period with the same total number of newly added data based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be investigated;

[0049] The change rate analysis unit is used to calculate the change rate of the access index corresponding to the target user based on the access rights;

[0050] The user and permission processing unit is used to analyze whether the user is a risky user based on the change rate value. If the user is a risky user, the risky user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risky user as an asset user are extracted for early warning.

[0051] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention analyzes the asset space constructed by 3D digital assets, takes the space with high risk level as the analysis carrier, extracts the access operations performed by the asset users in the corresponding space and analyzes the impact on the security of the remaining asset spaces, and finally extracts users with higher risk potential and corresponding permissions based on trend analysis for risk management; it realizes strong supervision of digital assets based on the zero-trust security model, which not only strengthens the access standardization of the digital space, but also analyzes the security assessment of the operation behavior under the permission of the newly added permissions, and captures suspicious users. It is not only a point-to-point permission response analysis, but more of a trend judgment based on the overall trajectory of the same user based on the digital assets, and eliminates potential exposure points by upgrading or deleting permissions, ensuring the effective capture of anomalies and trend analysis in dynamic access situations, improving the security of digital assets in the circulation process, and reasonably analyzing the risk planning of each digital asset user for possible security impacts on digital assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0053] Figure 1 It is a structural schematic diagram of a 3D digital asset security supervision system based on blockchain in the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] See also Figure 1 The present invention provides a technical solution: a 3D digital asset security supervision method based on blockchain, comprising the following analysis steps:

[0056] Step S100: Acquire all behavior data of the asset owner for constructing a 3D digital asset record, the behavior data including asset identification, asset space and asset authority; analyze based on the behavior data that the 3D digital asset has an asset space corresponding to a risk value greater than or equal to a risk value threshold, and mark it as a first asset space;

[0057] Step S200: Implementing an access policy based on a zero-trust security model on the first asset space, and obtaining all access records of users other than the asset owner based on the first asset space in the zero-trust security model records within a monitoring period, and constructing an access record set;

[0058] Step S300: Based on the access record set, analyzing the access index of each user based on the first asset space;

[0059] Step S400: Extract users whose access index is less than the average access index as target users, estimate the change rate of the access index corresponding to the target users based on the access rights, screen the risk users and corresponding permissions of the zero-trust security model applied to the first asset space according to the change rate; and perform risk processing on the risk users and their permissions.

[0060] Step S100 includes the following specific steps:

[0061] Step S110: Asset identification refers to the identification and attributes set for the 3D digital asset subject; asset space refers to the data space where all historical digital assets are stored; asset authority refers to the establishment of corresponding operational authority and authority owner for each digital asset subject under each identification;

[0062] Step S120: The asset space includes several data spaces, and the sizes of the data spaces are different. The number K of attribute types recorded in each data space and the size value R of the data space are obtained, using the formula:

[0063]

[0064] Calculate the risk value y1 corresponding to each data space, where L represents the number of permission owners that can be set for one type of operable permission in each data space, m represents the number of operable permission types contained in the same data space; J represents the number of other data spaces where the permission owners in the same data space have corresponding operable permissions, and n represents the number of permission owners contained in the same data space; α, β, and γ represent the reference coefficients of the corresponding items; K / R represents the number of digital asset attribute types that can be accommodated under the unit data space size; the more types that are accommodated, the more data affected by the assets located when data risks occur, and the greater the risk;

[0065] Step S130: Obtain security events with abnormal responses in historical records, where abnormal responses refer to response records generated when 3D digital assets are leaked or attacked; extract the data space corresponding to the security event record and L, J, K, R, n and m corresponding to the data space, and calculate the response risk values ​​of the data spaces corresponding to all security events; when the number of records in the data space where the security event occurs is not 1, mark the data space as the first data space, and calculate the average value of the response risk value corresponding to the first data space as the risk representative value of the first data space; extract the risk representative value y0 of each data space, and select the minimum risk representative value min(y0) as the risk value threshold.

[0066] Constructing an access record set includes the following specific steps:

[0067] Step S210: Mark users other than asset owners as asset users, take each asset user as a search item, traverse the first asset space to locate all access records of asset users, the access records include access address, access rights and verification method; and construct the minimum permission set Z based on asset users. The access address refers to the address information for accessing the first asset space record. i Indicates the i-th access address where the asset user has a record, f ei Indicates the verification method required by the corresponding asset user under the i-th access address, g fei Indicates the access rights after completing the verification method required by the corresponding asset user under the i-th access address;

[0068] Step S220: Based on the minimum permission set of each asset user, obtain the operation behavior data recorded after the access permission is granted to the corresponding access address, the operation behavior data includes security behavior data and abnormal behavior data; and record it as the access record set H, where x 1i represents the security behavior data of the i-th access address record, x 2i Represents the abnormal behavior data of the i-th access address record;

[0069] Step S300 includes the following steps:

[0070] Step S310: Mark the newly added operation behavior data x0 of each access record set by the asset user during the monitoring period, and traverse all access record sets stored by the same asset user. And x0∈{x 1i}, extract the operation behavior data x0 corresponding to the access address e i Same, f ei or feiDifferent second asset users, the second asset user refers to the asset user different from the operation behavior data x0, and the number of second asset users can be one or more; obtain the access record set of the second asset user, when x0 satisfies And x0∈{x 1i}When the corresponding access record set number V1 is greater than the average set number, the output operation behavior data x0 is safe behavior data;

[0071] Judging the same operation behavior data based on users with different access rights at the same address can effectively cover the diversity of executable operations based on the same address. If data under different types of permissions are all judged as safe behavior data, it means that the risk coefficient of the operation behavior data is low, and the adaptability and permissible operability are high; on the contrary, if there is abnormal behavior data, it means that the risk coefficient of the data is high, reflecting security issues from many aspects. For other types of data that do not meet the above two judgment methods, the significance of setting it as pending data is that the risk is lower than that of abnormal behavior data but higher than that of safe behavior data;

[0072] As shown in the embodiment: if there is an access record set recorded by asset user 1:

[0073] Extract the access record set of asset user 2 and asset user 3 corresponding to the same space address;

[0074] If the newly added operation behavior data x0=x 11 And x exists in the access record sets recorded by asset user 2 and asset user 3. 11 belongs to {x 1i}, then x0 is determined to be safe behavior data;

[0075] Step S320: When And x0∈{x 2i}, extract the second asset user record x0 to satisfy And x0∈{x 2i} The corresponding access record set number V2, when V2 is greater than the average set number, the output operation behavior data x0 is abnormal behavior data;

[0076] Step S330: Based on step S310 and step S320, when the operation behavior data x0 has all other data relationships with the access record set except for the safe behavior data and abnormal behavior data determination methods, the operation behavior data x0 is output as pending data;

[0077] Step S340: Obtain the number of records A1 of safe behavior data and the number of records B1 of abnormal behavior data in the historical access records of each asset user, as well as the number of times A2 of newly added operation behavior data determined as safe behavior data, the number of times B2 of newly added operation behavior data determined as abnormal behavior data, and the number of times C1 of pending data; using the formula:

[0078]

[0079] An access index W of the asset user based on the first asset space is calculated.

[0080] The larger the access index is, the safer the asset user's access to the asset space is.

[0081] Step S400 includes the following:

[0082] Step S410: Obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length h of the adjacent monitoring period with the same total number of newly added data based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be examined W1; use the formula:

[0083] Z=(W1-W) / h

[0084] Calculate the change rate Z of the target user's access index based on the access rights;

[0085] Step S420: When Z is less than 0, the corresponding target user is screened as a risk user, and the risk user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risk user as an asset user are extracted for early warning;

[0086] Step S430: When Z is greater than or equal to 0 and Z is greater than the change rate threshold, the target user is output as a safe user; when Z is greater than or equal to 0 and Z is less than or equal to the change rate threshold, extract the next adjacent monitoring period length that is the same as the total number of new additions and calculate the access index change rate corresponding to the next monitoring period, return to step S420 to determine the size relationship of Z, until a risky user or a safe user is output and the change rate monitoring is stopped.

[0087] Analyzing the change rate can effectively understand the impact of risky behaviors of asset users when operating digital assets on the security of asset space access, make trend judgments based on the overall trajectory of digital assets for the same user, eliminate potential exposure points by upgrading or deleting permissions, and effectively improve the security of the asset space.

[0088] A 3D digital asset security supervision system based on blockchain, comprising a first asset space marking module, an access policy implementation module, an access record set building module, an access index analysis module and a risk processing module;

[0089] The first asset space marking module is used to analyze the 3D digital assets based on the behavior data and find that the risk value of the 3D digital assets is greater than or equal to the risk value threshold and the asset space is marked as the first asset space;

[0090] The access policy enforcement module is used to enforce an access policy based on a zero-trust security model on the first asset space;

[0091] The access record set building module is used to obtain all access records of users other than the asset owner based on the first asset space in the zero-trust security model, and build an access record set;

[0092] The access index analysis module is used to analyze the access index of each user based on the first asset space;

[0093] The risk processing module is used to screen risky users and corresponding permissions of the zero-trust security model applied in the first asset space based on the change rate; and to perform risk processing on risky users and their permissions.

[0094] The first asset space marking module includes an asset identification generation unit, a risk value calculation unit and a risk value threshold output unit;

[0095] The asset identification generation unit is used to set the identification and attributes of the 3D digital asset subject;

[0096] The risk value calculation unit is used to obtain the number of attribute types contained in the 3D digital assets recorded in each data space and the size value of the data space, and calculate the risk value;

[0097] The risk value threshold output unit is used to obtain security events with abnormal responses in historical records and calculate the response risk values ​​of the data spaces corresponding to all security events; when the number of records in the data space where the security event occurred is not 1, the data space is marked as the first data space, and the average value of the response risk value corresponding to the first data space is calculated as the risk representative value of the first data space; the risk representative value of each data space is extracted, and the minimum risk representative value is selected as the risk value threshold.

[0098] The access index analysis module includes a new data analysis unit and an access index calculation unit;

[0099] The newly added data identification unit is used to identify whether the newly added operation behavior data of the asset user based on each access record set during the monitoring period is safe behavior data, abnormal behavior data or pending data;

[0100] The access index calculation unit is used to calculate the access index based on the number of times of the three data records.

[0101] The risk processing module includes an access index calculation unit to be examined, a change rate analysis unit, and a user and authority processing unit;

[0102] The access index calculation unit to be investigated is used to obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length of the adjacent monitoring period with the same total number of newly added data based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be investigated;

[0103] The change rate analysis unit is used to calculate the change rate of the access index corresponding to the target user based on the access rights;

[0104] The user and permission processing unit is used to analyze whether the user is a risky user based on the change rate value. If the user is a risky user, the risky user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risky user as the asset user are extracted for early warning.

[0105] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0106] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A 3D digital asset security supervision method based on blockchain, It is characterized in that The analysis steps include: Step S100: Acquire all behavior data of the asset owner for constructing a 3D digital asset record, wherein the behavior data includes asset identification, asset space, and asset authority; Based on the behavioral data analysis, the 3D digital assets have an asset space corresponding to a risk value greater than or equal to the risk value threshold, and are marked as the first asset space; The asset space refers to the data space where all historical record digital assets are stored; Step S200: Implementing an access policy based on a zero-trust security model on the first asset space, and obtaining all access records of users other than the asset owner based on the first asset space in the zero-trust security model records within a monitoring period, and constructing an access record set; The construction of the access record set includes the following specific steps: Step S210: Mark users other than asset owners as asset users, take each asset user as a search item, traverse the first asset space to locate all access records of asset users, the access records include access address, access rights and verification method; and construct a minimum permission set Z based on asset users. The access address refers to the address information for accessing the first asset space record. i Indicates the i-th access address where the asset user has a record, f ei Indicates the verification method required by the corresponding asset user under the i-th access address, g fei Indicates the access rights after completing the verification method required by the corresponding asset user under the i-th access address; Step S220: Based on the minimum permission set of each asset user, obtain the operation behavior data recorded after the corresponding access address is granted access rights, the operation behavior data includes security behavior data and abnormal behavior data; and record it as the access record set H, where x 1i represents the security behavior data of the i-th access address record, x 2i Represents the abnormal behavior data of the i-th access address record; Step S300: Based on the access record set, analyzing the access index of each user based on the first asset space; The step S300 includes the following steps: Step S310: Mark the newly added operation behavior data x of the asset user based on each access record set during the monitoring period 0 , traverse all access record sets stored by the same asset user, when And x 0 ∈{X 1i }, extract the operation behavior data x 0 Corresponding access address e i Same, fe i or gfe i Different second asset users, the second asset users are different from the operation behavior data x 0 The number of the second asset users can be one or more; the access record set of the second asset users is obtained, when x 0 satisfy And x 0 ∈{x 1i }The number of access record sets corresponding to V 1 When the number of sets is greater than the average, output the operation behavior data x 0 For safety behavior data; Step S320: When And x 0 ∈{x 2i }, extract the second asset user record x 0 satisfy And x 0 ∈{x 2i }The number of access record sets corresponding to V 2 , when V 2 When the number of sets is greater than the average, output the operation behavior data x 0 Abnormal behavior data; Step S330: Based on step S310 and step S320, when the operation behavior data x 0 When there is any data relationship with the access record set except for the safe behavior data and abnormal behavior data judgment method, the operation behavior data x is output 0 The data is pending; Step S340: Obtain the number of records of security behavior data in the historical access records of each asset user A 1 and the number of records of abnormal behavior data B 1 , and the number of times the newly added operation behavior data is determined to be safe behavior data A 2 , the number of times the data is judged as abnormal behavior B 2 and the number of pending data C 1 ; Using the formula: Calculate an access index W of the asset user based on the first asset space; Step S400: extracting users whose access index is less than the average access index as target users, estimating the change rate of the access index corresponding to the target users based on the access rights, and screening risk users and corresponding rights of the first asset space application zero trust security model according to the change rate; And handle risky users and their permissions.

2. According to the blockchain-based 3D digital asset security supervision method of claim 1, Features: The step S100 includes the following specific steps: Step S110: The asset identification refers to the identification and attributes set for the 3D digital asset subject, and the asset authority refers to the establishment of corresponding operational authority and authority owner for the digital asset subject under each identification; Step S120: The asset space includes a plurality of data spaces, and the sizes of the data spaces are different. The number K of attribute types recorded in each data space and the size value R of the data space are obtained, using the formula: Calculate the risk value y1 corresponding to each data space, where L represents the number of permission owners that can be set for one type of operable permission in each data space, m represents the number of operable permission types contained in the same data space; J represents the number of other data spaces where the permission owners in the same data space have corresponding operable permissions, and n represents the number of permission owners in the same data space; α, β, and γ represent the reference coefficients of the corresponding items; K / R represents the number of digital asset attribute types that can be accommodated under the unit data space size; Step S130: Obtain security events with abnormal responses in historical records, where the abnormal responses refer to response records generated when 3D digital assets are leaked or attacked; extract the data space corresponding to the security event records and L, J, K, R, n and m corresponding to the data space, and calculate the response risk values ​​of the data spaces corresponding to all security events; When the number of records of the data space where the security event occurs is not 1, mark the data space as the first data space, and calculate the average value of the response risk values ​​corresponding to the first data space as the risk representative value of the first data space; Extract the risk representative value y0 of each data space, select the minimum risk representative value min(y 0 ) as the risk value threshold.

3. According to the blockchain-based 3D digital asset security supervision method of claim 2, Features: The step S400 includes the following: Step S410: Obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length h of the adjacent monitoring period with the same total number of newly added data based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be examined W 1 ; Using the formula: Z=(W 1 -W) / h Calculate the change rate Z of the target user's access index based on the access rights; Step S420: When Z is less than 0, the corresponding target user is screened as a risk user, and the risk user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risk user as an asset user are extracted for early warning; Step S430: When Z is greater than or equal to 0 and Z is greater than the change rate threshold, the target user is output as a safe user; when Z is greater than or equal to 0 and Z is less than or equal to the change rate threshold, extract the next adjacent monitoring period length that is the same as the total number of new additions and calculate the access index change rate corresponding to the next monitoring period, return to step S420 to determine the size relationship of Z, until a risky user or a safe user is output and the change rate monitoring is stopped.

4. A blockchain-based 3D digital asset security supervision system, using a blockchain-based 3D digital asset security supervision system as described in any one of claims 1-3, It is characterized in that It includes a first asset space marking module, an access policy implementation module, an access record set building module, an access index analysis module and a risk processing module; The first asset space marking module is used to analyze the 3D digital assets based on the behavior data and find that the risk value of the 3D digital assets is greater than or equal to the risk value threshold and the asset space is marked as the first asset space; The access policy implementation module is used to implement an access policy based on a zero-trust security model on the first asset space; The access record set building module is used to obtain all access records of users other than the asset owner based on the first asset space from the zero-trust security model record, and build an access record set; The access index analysis module is used to analyze the access index of each user based on the first asset space; The risk processing module is used to screen risk users and corresponding permissions of the zero-trust security model applied to the first asset space according to the change rate; And handle risky users and their permissions.

5. According to the blockchain-based 3D digital asset security supervision system of claim 4, Features: The first asset space marking module includes an asset identification generation unit, a risk value calculation unit and a risk value threshold output unit; The asset identification generation unit is used to set identification and attributes for the 3D digital asset subject; The risk value calculation unit is used to obtain the number of attribute types recorded in each data space and the size of the data space, and calculate the risk value; The risk value threshold output unit is used to obtain security events with abnormal responses in historical records and calculate the response risk values ​​of data spaces corresponding to all security events; When the number of records of the data space where the security event occurs is not 1, mark the data space as the first data space, and calculate the average value of the response risk values ​​corresponding to the first data space as the risk representative value of the first data space; The risk representative value of each data space is extracted, and the minimum risk representative value is selected as the risk value threshold.

6. According to the blockchain-based 3D digital asset security supervision system of claim 5, Features: The access index analysis module includes a new data identification unit and an access index calculation unit; The newly added data identification unit is used to identify whether the newly added operation behavior data of the asset user based on each access record set during the monitoring period is safe behavior data, abnormal behavior data or pending data; The access index calculation unit is used to calculate the access index based on the number of times of three types of data records.

7. According to the blockchain-based 3D digital asset security supervision system of claim 6, Features: The risk processing module includes an access index calculation unit to be examined, a change rate analysis unit and a user and authority processing unit; The access index calculation unit to be investigated is used to obtain the total number of newly added operation behavior data of the target user based on the access rights within the monitoring period, measure the length of the adjacent monitoring period with the same total number of newly added operations based on the total number, and mark the access index calculated corresponding to the adjacent monitoring period as the access index to be investigated; The change rate analysis unit is used to calculate the change rate of the access index corresponding to the target user based on the access rights; The user and permission processing unit is used to analyze whether the user is a risky user based on the change rate value. If the user is a risky user, the risky user information is transmitted to the asset security supervision system to remind the administrator to supervise, and the access rights recorded in the minimum permission set of the risky user as an asset user are extracted for early warning.

Images