Secure access processing method, device, equipment and storage medium

Abstract

The present application relates to the field of data processing technology, and discloses a method, device, equipment and storage medium for processing secure access. The method includes: initializing multimodal resource data and data domain sets to obtain a resource list and an access control policy matrix; parsing user access requests to obtain request parsing data and classifying data to obtain a request data queue; processing multiple local access control policies together to obtain a fused access control policy, constructing an integer linear programming model based on the fused access control policy, solving the integer linear programming model, obtaining a global access control policy and performing a security assessment to obtain a security assessment report; updating the global access control policy to obtain a target access control policy; and continuously monitoring multiple data terminals in a multi-domain environment to generate a monitoring status report. The present application improves the security and efficiency of secure access processing.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a secure access processing method, device, equipment and storage medium. Background Art

[0002] In the prior art, the processing methods for secure access are mainly focused on a single field or a single type of access control strategy, usually using access control methods based on predefined rules or roles. These methods can better guarantee secure access to resources in a single environment, but with the emergence of multimodal resource data and multi-domain environments, traditional methods are difficult to cope with complex and changeable access requests and cross-domain resource access requirements. Specifically, the prior art often lacks unified standards in feature extraction, classification, and clustering of multimodal resource data, resulting in low efficiency in the data initialization processing stage.

[0003] The deficiency of the existing technology is that there are great challenges in merging access control policies and formulating global access control policies in a multi-domain environment. When faced with multiple local access control policies in a multi-domain environment, traditional methods are difficult to achieve effective integration and optimization of policies, resulting in a complex and inefficient generation process of global access control policies. In addition, the existing methods also lack effective automation means in terms of security assessment and policy updates of global access control policies, making it difficult to ensure the real-time and accuracy of the policies, thus affecting the security and stability of the overall system. Summary of the invention

[0004] The present application provides a method, apparatus, device and storage medium for processing secure access, which are used to improve the security and efficiency of the secure access processing process.

[0005] In a first aspect, the present application provides a method for processing secure access, the method comprising: initializing the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix;

[0006] Parsing the received user access request to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and classifying the request parsing data to obtain a request data queue;

[0007] Merging multiple local access control policies in a multi-domain environment to obtain a fused access control policy, constructing an integer linear programming model according to the fused access control policy, and solving the integer linear programming model to obtain a global access control policy;

[0008] Performing a security assessment on the global access control policy to obtain a security assessment report;

[0009] The global access control policy is updated through the security assessment report to obtain a target access control policy;

[0010] Continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy, and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

[0011] In combination with the first aspect, in a first implementation of the first aspect of the present application, the initialization processing of the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix includes:

[0012] Performing feature extraction on the multimodal resource data to obtain a resource feature vector set;

[0013] Performing cluster analysis on the multimodal resource data according to the resource feature vector set to obtain a resource category set;

[0014] Performing encoding processing on the resource category set to obtain a resource encoding vector set;

[0015] Constructing a resource tree structure according to the resource coding vector set to obtain a resource hierarchy model;

[0016] Modeling the inter-domain relationships of the data domain set to obtain a domain relationship matrix;

[0017] Classifying the data domain set according to the domain relationship matrix to obtain a domain category set;

[0018] Performing encoding processing on the domain category set to obtain a domain encoding vector set;

[0019] Constructing a domain tree structure according to the domain coding vector set to obtain a domain hierarchical model;

[0020] Construct a resource-domain mapping relationship according to the resource hierarchy model and the domain hierarchy model to obtain a resource list;

[0021] An access control policy matrix is ​​generated according to the resource list and preset access control rules.

[0022] In combination with the first aspect, in a second implementation of the first aspect of the present application, the received user access request is parsed to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and the request parsing data is classified to obtain a request data queue, including:

[0023] Parsing the user access request in a request format to obtain request format data;

[0024] Extracting user identity information according to the request format data to obtain a user identity vector;

[0025] Authentication is performed on the user identity vector to obtain a user identity;

[0026] Extracting the requested resource information according to the request format data to obtain a resource identification vector;

[0027] Searching for a corresponding resource in the resource list according to the resource identification vector to obtain the requested resource;

[0028] Extracting access type information according to the request format data to obtain an access type code;

[0029] constructing a request parsing vector according to the user identity, the requested resource and the access type code;

[0030] Performing feature extraction on the request parsing vector to obtain a request feature vector;

[0031] Classifying the request parsing vector according to the request feature vector to obtain an access type;

[0032] The request parsing vector is stored in a request data queue according to the access type.

[0033] In combination with the first aspect, in a third implementation of the first aspect of the present application, the merging of multiple local access control policies in a multi-domain environment to obtain a fused access control policy, constructing an integer linear programming model according to the fused access control policy, and solving the integer linear programming model to obtain a global access control policy includes:

[0034] Performing policy format standardization processing on multiple local access control policies in the multi-domain environment to obtain a standardized policy set;

[0035] Extracting policy elements according to the standardized policy set to obtain a policy element set;

[0036] Deduplication processing is performed on the set of policy elements to obtain a unique set of policy elements;

[0037] Constructing a policy element relationship matrix according to the unique policy element set;

[0038] Performing principal component analysis on the strategy element relationship matrix to obtain a principal component vector set;

[0039] Performing dimensionality reduction processing on the unique strategy element set according to the principal component vector set to obtain a low-dimensional strategy element set;

[0040] Constructing the objective function and constraint conditions of the integer linear programming model according to the low-dimensional strategy element set;

[0041] Converting the integer linear programming model into a standard form to obtain a standard integer linear programming model;

[0042] Solving the standard integer linear programming model to obtain a solution vector;

[0043] The fused access control policy is reconstructed according to the solution vector to obtain a global access control policy.

[0044] In combination with the first aspect, in a fourth implementation of the first aspect of the present application, the performing of a security assessment on the global access control policy to obtain a security assessment report includes:

[0045] Performing policy semantic analysis on the global access control policy to obtain a policy semantic tree;

[0046] Extracting a set of policy rules according to the policy semantic tree;

[0047] Performing rule conflict detection on the policy rule set to obtain a set of conflicting rule pairs;

[0048] Constructing a rule conflict graph according to the set of conflicting rules;

[0049] Calculating the minimum point cover set on the rule conflict graph to obtain a minimum conflict rule set;

[0050] Modifying the global access control policy according to the minimum conflict rule set to obtain a modified policy;

[0051] Performing policy consistency verification on the revised policy to obtain a consistency verification result;

[0052] Performing strategy optimization on the revised strategy according to the consistency verification result to obtain an optimized strategy;

[0053] Calculating the policy security metric value for the optimized policy to obtain a security metric value;

[0054] A security assessment report is generated according to the security metric value.

[0055] In combination with the first aspect, in a fifth implementation of the first aspect of the present application, updating the global access control policy through the security assessment report to obtain a target access control policy includes:

[0056] Performing report structure analysis on the safety assessment report to obtain a report element set;

[0057] Extracting strategy optimization suggestions according to the report element set to obtain an optimization suggestion set;

[0058] Classifying the optimization suggestion set to obtain a classified suggestion set;

[0059] Constructing an optimized decision tree according to the classification suggestion set;

[0060] Extracting policy elements from the global access control policy to obtain a policy element set;

[0061] Performing optimization decision on the strategy element set according to the optimization decision tree to obtain an optimized strategy element set;

[0062] Performing strategy semantic construction on the optimization strategy element set to obtain an optimization strategy semantic model;

[0063] Generate a target access control policy original text according to the optimized policy semantic model;

[0064] Performing policy formatting on the target access control policy original text to obtain a formatted policy text;

[0065] The policy library is updated according to the formatted policy text to obtain the target access control policy.

[0066] In combination with the first aspect, in a sixth implementation of the first aspect of the present application, the multiple data terminals in the multi-domain environment are continuously monitored according to the target access control policy to generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data, including:

[0067] Performing policy deployment on the target access control policy to obtain a deployment policy set;

[0068] Deploy corresponding policy agents on the multiple data terminals according to the deployment policy set;

[0069] The policy agent intercepts the access request of the terminal and obtains interception request data;

[0070] Performing access decision on the intercept request data according to the target access control policy to obtain an access decision result;

[0071] Perform corresponding access control operations on the intercept request data according to the access decision result to obtain an access control log;

[0072] The policy agent monitors the system status of the terminal to obtain system status data;

[0073] generating a local monitoring report based on the access control log and the system status data;

[0074] The policy agent uploads the local monitoring report to the monitoring center;

[0075] The monitoring center performs data fusion on all received local monitoring reports to obtain a global monitoring data set;

[0076] A monitoring status report is generated according to the global monitoring data set, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

[0077] In a second aspect, the present application provides a secure access processing device, the secure access processing device comprising:

[0078] A processing module is used to initialize the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix;

[0079] A parsing module, configured to parse the received user access request to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and classify the request parsing data to obtain a request data queue;

[0080] A merging module, used to merge multiple local access control policies in a multi-domain environment to obtain a fused access control policy, construct an integer linear programming model according to the fused access control policy, and solve the integer linear programming model to obtain a global access control policy;

[0081] An evaluation module, used to perform a security evaluation on the global access control policy and obtain a security evaluation report;

[0082] An updating module, used to update the global access control policy through the security assessment report to obtain a target access control policy;

[0083] The monitoring module is used to continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

[0084] The third aspect of the present application provides a secure access processing device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the secure access processing device executes the above-mentioned secure access processing method.

[0085] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned secure access processing method.

[0086] In the technical solution provided by the present application, by extracting and classifying the features of multimodal resource data, generating a resource feature vector set and a resource category set, the efficiency of data initialization processing is improved. By constructing a resource tree structure and a domain hierarchical model, the orderly organization of resources and domains is realized, which is convenient for the subsequent access control policy formulation. Through request format parsing and user identity authentication, the accuracy and legitimacy of user identity are ensured. Request resource information and access type information are extracted, a request parsing vector is constructed, user access requests are accurately classified, and a request data queue is formed for subsequent processing. The policy format standardization processing and policy element deduplication are adopted to ensure the effective integration of local access control policies in a multi-domain environment. Through principal component analysis and dimensionality reduction processing, the policy element set is simplified, the complexity of policy merging is reduced, and the generation efficiency of the global access control policy is improved. Policy semantic parsing and rule conflict detection are performed on the global access control policy to ensure the correctness and consistency of the policy rules. Through the rule conflict graph and the minimum point covering set calculation, potential conflicting rules are discovered and corrected, which improves the security and reliability of the policy. Optimization suggestions are extracted based on the security assessment report, and the global access control policy is updated by optimizing the decision tree to generate the target access control policy. Dynamic optimization and real-time updating of policies are achieved, ensuring the adaptability and effectiveness of access control policies. By deploying policy agents on multiple data terminals, access requests are intercepted and processed in real time, generating access control logs and system status data. Local monitoring reports are integrated to generate global monitoring data sets and monitoring status reports, providing comprehensive terminal security status and access behavior data, and enhancing the system's security monitoring capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0088] Figure 1 A schematic diagram of an embodiment of a method for processing secure access in an embodiment of the present application;

[0089] Figure 2 A schematic diagram of an embodiment of a processing device for secure access in an embodiment of the present application. DETAILED DESCRIPTION

[0090] Embodiments of the present application provide a processing method, device, equipment and storage medium for secure access. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or precedence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than the content illustrated or described here. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0091] For ease of understanding, the specific process of the embodiment of the present application is described below. Figure 1 , an embodiment of a method for processing secure access in an embodiment of the present application includes:

[0092] Step S101: Initialize the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix;

[0093] It is understandable that the execution subject of the present application may be a processing device for secure access, or a terminal or a server, which is not specifically limited here. The present application embodiment is described by taking a server as the execution subject as an example.

[0094] Specifically, feature extraction is performed on multimodal resource data, representative features are extracted from different types of data, and a resource feature vector set is obtained. Cluster analysis is performed on multimodal resource data based on the resource feature vector set, and resource data with similar features are classified using a clustering algorithm to obtain a resource category set. The resource category set is encoded, and each type of resource is assigned a unique code by setting a unique encoding rule to obtain a resource encoding vector set. Based on the resource encoding vector set, a resource tree structure is constructed, and resource categories are organized according to a hierarchical relationship to obtain a resource hierarchy model. Inter-domain relationship modeling is performed on the data domain set, and the correlation and interaction between the domains are analyzed to construct a domain relationship matrix. Based on the domain relationship matrix, the data domain set is classified, and domains with similar relationships or attributes are identified to obtain a domain category set. The domain category set is encoded, and each domain category is assigned a unique code by a method similar to resource encoding to obtain a domain encoding vector set. Based on the domain encoding vector set, a domain tree structure is constructed, and domains are organized according to a hierarchical relationship to form a domain hierarchy model. According to the resource hierarchy model and the domain hierarchy model, a resource-domain mapping relationship is constructed to obtain a resource list. According to the resource list and the preset access control rules, an access control policy matrix is ​​generated.

[0095] Step S102: parsing the received user access request to obtain parsed request data, wherein the parsed request data includes: user identity, requested resource and access type, and classifying the parsed request data to obtain a request data queue;

[0096] Specifically, the received user access request is parsed in the request format, and the request format data is obtained by parsing the format and structure of the request. User identity information is extracted according to the request format data, and the user identity field in the request is identified to obtain a user identity vector. The user identity vector is authenticated, and the real identity of the user is confirmed by comparing it with a pre-stored identity database to obtain a verified user identity. Request resource information is extracted according to the request format data, and the resource identification vector is obtained by parsing the resource field pointed to in the request. According to the resource identification vector, the corresponding resource is searched in the pre-built resource list, and the specific resource pointed to by the request is confirmed to obtain the requested resource. Access type information is extracted according to the request format data, and the access type code is obtained by identifying the access action field in the request. These codes may include different access operations such as read, write, modify, and delete. A request parsing vector is constructed according to the user identity, the request resource, and the access type code, and the user identity, the request resource, and the access type code are integrated into a unified data vector. Feature extraction is performed on the request parsing vector, and information representing the request feature is extracted by analyzing the various components of the request parsing vector to obtain a request feature vector. According to the request feature vector, the request parsing vector is classified, and the request parsing vector is divided into different access types through a classification algorithm to obtain a specific access type. According to the access type, the request parsing vector is stored in a request data queue.

[0097] Step S103: merge multiple local access control policies in the multi-domain environment to obtain a fused access control policy, construct an integer linear programming model according to the fused access control policy, and solve the integer linear programming model to obtain a global access control policy;

[0098] Specifically, the policy formats of multiple local access control policies in a multi-domain environment are standardized, and the local access control policies in different domains are converted into a unified standard format to form a standardized policy set. Policy elements are extracted according to the standardized policy set, and the basic components of each policy, such as users, resources, operation types, conditions, etc., are analyzed to obtain a policy element set. The policy element set is deduplicated to eliminate duplicate policy elements to ensure that each policy element is unique in the set, and a unique policy element set is obtained. A policy element relationship matrix is ​​constructed according to the unique policy element set, and a matrix representing these relationships is constructed by analyzing the relationships and dependencies between policy elements. Principal component analysis is performed on the policy element relationship matrix to extract the principal components that can represent the characteristics of the original data to obtain a principal component vector set. The unique policy element set is subjected to dimensionality reduction processing according to the principal component vector set, and the original high-dimensional data is mapped to a low-dimensional space to obtain a low-dimensional policy element set. The objective function and constraints of the integer linear programming model are constructed based on the set of low-dimensional policy elements. The objective function is usually used to optimize a specific access control goal, such as minimizing conflicts, maximizing security, etc., while the constraints are used to ensure that the constructed model meets the actual access control requirements and restrictions. The integer linear programming model is converted into a standard form, and the model is converted into a standard integer linear programming model through mathematical transformation and simplification. The standard integer linear programming model is solved and the solution vector of the model is calculated using an optimization algorithm such as the simplex method or the branch and bound method. The solution vector is the best strategy combination obtained during the optimization process, which can meet all constraints and optimize the objective function. The fusion access control policy is reconstructed based on the solution vector, and the final global access control policy is formed by converting the information in the solution vector into specific access control rules and policies.

[0099] Step S104: Perform a security assessment on the global access control policy to obtain a security assessment report;

[0100] Specifically, the global access control policy is semantically parsed. Natural language processing technology and semantic analysis tools are used to parse the various contents and logical relationships of the policy to obtain a policy semantic tree, which describes the structure and logic of the policy. The policy rule set is extracted according to the policy semantic tree, and specific access control rules are extracted from the semantic tree to form a rule set. Rule conflict detection is performed on the policy rule set. The conflict detection algorithm is used to analyze the mutual relationship between the rules, find out the rule pairs with contradictions or conflicts, and obtain a set of conflicting rule pairs. A rule conflict graph is constructed based on the set of conflicting rule pairs, and the conflicting rule pairs are mapped to nodes and edges in the graph to intuitively display the conflict relationship between the rules. On this basis, the minimum point covering set is calculated for the rule conflict graph, and the minimum point covering set algorithm in graph theory is used to find the minimum node set, which covers all conflicting edges, so as to obtain the minimum conflicting rule set. This helps to minimize the impact of conflicts on system security without destroying the overall policy structure. According to the minimum conflicting rule set, the global access control policy is modified. By adjusting or deleting the conflicting rules, the logical consistency and security of the policy are ensured, and the modified policy is obtained. Perform policy consistency verification on the revised policy. Use consistency verification tools and methods to check the logical relationship and consistency within the policy to ensure that the revised policy has no new conflicts and contradictions, and obtain consistency verification results. According to the consistency verification results, optimize the revised policy. Improve the execution efficiency and security performance of the policy through optimization algorithms and policy adjustments to obtain the optimized policy. Calculate the policy security metric value for the optimized policy. Use security assessment models and indicators to quantitatively evaluate the various security performances of the policy to obtain security metric values. Generate a security assessment report based on the security metric values, and integrate the metric values ​​and various analysis results in the assessment process to form a security assessment report.

[0101] Step S105: Update the global access control policy through the security assessment report to obtain a target access control policy;

[0102] Specifically, the security assessment report is analyzed for report structure, and the content of the security assessment report is decomposed into various components to obtain a set of report elements. Policy optimization suggestions are extracted based on the set of report elements, and the improvement suggestions on the access control policy in the report are analyzed to form an optimization suggestion set. The optimization suggestion set is classified, and similar or related optimization suggestions are grouped through analysis and induction to obtain a classified suggestion set. An optimization decision tree is constructed based on the classified suggestion set, and the various optimization suggestions are constructed into a decision tree structure according to the logical relationship and priority by using the decision tree algorithm, which intuitively represents the decision path and priority in the optimization process. Policy elements are extracted from the global access control policy, and the basic elements in the policy are extracted to obtain a set of policy elements. These elements include user identity, access resources, operation type, etc. Next. According to the optimized decision tree, the policy element set is optimized and decided. Through comparison and analysis, the suggestions in the optimized decision tree are applied to the policy element set to obtain an optimized policy element set. Policy semantics are constructed for the optimized policy element set, and the optimized policy elements are converted into a structured policy semantic model by using natural language processing and semantic analysis technology. Generate the target access control policy original text according to the optimized policy semantic model, convert the semantic model into a formal policy text, and form the target access control policy original text. Perform policy formatting on the target access control policy original text, typeset and adjust the policy text according to the preset standards and formats, and obtain the formatted policy text. Update the policy library according to the formatted policy text, and add the new target access control policy to the policy library to ensure that the system uses the latest policy in actual applications and obtain the final target access control policy.

[0103] Step S106: Continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

[0104] Specifically, the target access control policy is deployed, and the policy is decomposed into specific execution steps and rules to obtain a deployment policy set. According to the deployment policy set, the corresponding policy agent is deployed on multiple data terminals. By installing and configuring the policy agent on each data terminal, it can execute and manage the deployment policy. The policy agent intercepts the access request of the terminal, captures and records each access request by monitoring all access activities on the terminal, and obtains the interception request data. According to the target access control policy, the interception request data is accessed and decided, and the access decision result is generated by comparing the request data with the predefined access control rules. According to the access decision result, the corresponding access control operation is performed on the interception request data to form an access control log. The policy agent monitors the system status of the terminal, collects and records various status data of the terminal in real time, such as CPU usage, memory usage, network traffic, etc., to obtain system status data. A local monitoring report is generated based on the access control log and system status data, and the access behavior and security status of the terminal are comprehensively sorted out to form a report. The policy agent uploads the local monitoring report to the monitoring center, and the monitoring data of each terminal is centralized to a unified platform through a secure communication channel. At the monitoring center, all local monitoring reports received are fused. Through data fusion technology, monitoring data from different terminals are integrated and analyzed to eliminate redundant information, extract key information, and obtain a global monitoring data set. Based on the global monitoring data set, a monitoring status report is generated, including terminal security status data and terminal access behavior data.

[0105] In the embodiment of the present application, by extracting and classifying the features of multimodal resource data, generating a resource feature vector set and a resource category set, the efficiency of data initialization processing is improved. By constructing a resource tree structure and a domain hierarchical model, the orderly organization of resources and domains is realized, which is convenient for the subsequent access control policy formulation. Through request format parsing and user identity authentication, the accuracy and legitimacy of user identity are ensured. Request resource information and access type information are extracted, a request parsing vector is constructed, user access requests are accurately classified, and a request data queue is formed for subsequent processing. The policy format standardization processing and policy element deduplication are adopted to ensure the effective integration of local access control policies in a multi-domain environment. Through principal component analysis and dimensionality reduction processing, the policy element set is simplified, the complexity of policy merging is reduced, and the generation efficiency of the global access control policy is improved. Policy semantic parsing and rule conflict detection are performed on the global access control policy to ensure the correctness and consistency of the policy rules. Through the rule conflict graph and the minimum point covering set calculation, potential conflicting rules are discovered and corrected, which improves the security and reliability of the policy. Optimization suggestions are extracted based on the security assessment report, and the global access control policy is updated by optimizing the decision tree to generate the target access control policy. Dynamic optimization and real-time updating of policies are achieved, ensuring the adaptability and effectiveness of access control policies. By deploying policy agents on multiple data terminals, access requests are intercepted and processed in real time, generating access control logs and system status data. Local monitoring reports are integrated to generate global monitoring data sets and monitoring status reports, providing comprehensive terminal security status and access behavior data, and enhancing the system's security monitoring capabilities.

[0106] In a specific embodiment, the process of executing step S101 may specifically include the following steps:

[0107] (1) Extract features from multimodal resource data to obtain a set of resource feature vectors;

[0108] (2) Cluster analysis is performed on multimodal resource data based on the resource feature vector set to obtain a resource category set;

[0109] (3) Encoding the resource category set to obtain a resource encoding vector set;

[0110] (4) constructing a resource tree structure based on the resource coding vector set to obtain a resource hierarchy model;

[0111] (5) Model the inter-domain relationships of the data domain set to obtain a domain relationship matrix;

[0112] (6) Classify the data domain set according to the domain relationship matrix to obtain a domain category set;

[0113] (7) Encoding the domain category set to obtain a domain encoding vector set;

[0114] (8) constructing a domain tree structure based on the domain coding vector set to obtain a domain hierarchical model;

[0115] (9) Construct resource-domain mapping relationship based on resource hierarchy model and domain hierarchy model to obtain resource list;

[0116] (10) Generate an access control policy matrix based on the resource list and preset access control rules.

[0117] Specifically, feature extraction is performed on multimodal resource data, and representative features are extracted from the multimodal resource data using feature extraction technology. Each resource contains different types of information, such as text, images, videos, etc. These resources are converted into a set of feature vectors through a feature extraction algorithm. For example, for image data, a convolutional neural network is used for feature extraction, and for text data, a word vector model (such as Word2Vec or BERT) can be used for feature representation. Cluster analysis is performed on multimodal resource data based on the resource feature vector set. Similar resources are grouped to form a set of resource categories. Assume that the feature vector set is {v1,v2,...,v n}, use K-means clustering algorithm for clustering analysis. The goal of the K-means algorithm is to minimize the sum of square errors within the cluster, and the formula is expressed as:

[0118]

[0119] Where K is the number of clusters, C k represents the kth cluster, μ k represents the centroid of the kth cluster. Through cluster analysis, we get the resource category set {C1, C2, ..., C K}. Encode the resource category set, assign a unique code to each type of resource by setting a unique coding rule, and obtain a resource coding vector set. For example, use binary coding or hash coding method to assign a unique code to each category. Construct a resource tree structure based on the resource coding vector set. Through the hierarchical clustering method, organize the resource categories according to the hierarchical relationship to form a resource hierarchy model. For example, use a hierarchical clustering algorithm (such as agglomerative hierarchical clustering or divisive hierarchical clustering) to construct a resource tree structure. Assume that the resource coding vector set is {e1,e2,...,e K}, through hierarchical clustering, we get a resource hierarchy model, where each node represents a resource category and each edge represents the hierarchical relationship between categories. We model the inter-domain relationship of the data domain set and build a domain relationship matrix by analyzing the correlation and interaction between the domains. Assume that the data domain set is {D1,D2,...,D m}, construct the domain relationship matrix A through domain relationship modeling methods (such as association rule mining or social network analysis), where A ij Indicates field D i and field D j The strength of the relationship between two domains. For example, if there is frequent interaction between two domains, the strength of their relationship is high. Classify the data domain set according to the domain relationship matrix, identify the domains with similar relationships or attributes, and obtain a set of domain categories. Use the spectral clustering algorithm to classify the domain relationship matrix. Through the eigenvalue decomposition of the matrix, the data is projected into a low-dimensional space for classification. Assuming that the domain relationship matrix is ​​A, the spectral clustering algorithm can be expressed as:

[0120]

[0121] Among them, y i and j is the projection vector in the low-dimensional space. Through spectral clustering, we get the domain category set {D1,D2,...,D l}. Encode the domain category set, and assign a unique code to each domain category through a method similar to resource encoding to obtain a set of domain coding vectors. Construct a domain tree structure based on the set of domain coding vectors. Through the hierarchical clustering method, organize the domain categories according to the hierarchical relationship to form a domain hierarchy model, in which each node represents a domain category and each edge represents the hierarchical relationship between categories. Construct a resource-domain mapping relationship based on the resource hierarchy model and the domain hierarchy model, and obtain a detailed resource list by analyzing the correlation between resources and domains. Through the access control policy generation algorithm, generate an access control policy matrix based on the resource list and preset access control rules.

[0122] In a specific embodiment, the process of executing step S102 may specifically include the following steps:

[0123] (1) Parse the user access request in a request format to obtain request format data;

[0124] (2) extracting user identity information according to the request format data to obtain a user identity vector;

[0125] (3) Authenticate the user identity vector to obtain the user identity;

[0126] (4) extracting the requested resource information according to the request format data to obtain a resource identification vector;

[0127] (5) Search the corresponding resource in the resource list according to the resource identification vector to obtain the requested resource;

[0128] (6) Extract access type information according to the request format data to obtain the access type code;

[0129] (7) construct a request parsing vector based on the user identity, requested resource, and access type encoding;

[0130] (8) Extracting features from the request parsing vector to obtain a request feature vector;

[0131] (9) Classify the request parsing vector according to the request feature vector to obtain the access type;

[0132] (10) Store the request parsing vector into the request data queue according to the access type.

[0133] Specifically, the request format of the user access request is parsed, and the key information is extracted by parsing the format and structure of the request. For example, an HTTP request may contain header information, request path, request method, and request body. By parsing these contents, the request format data is obtained. The user identity information is extracted according to the request format data. The user identity information is usually contained in the request header or request body, such as user name, user ID, or token. By parsing these fields in the request format data, the user identity information is extracted to form a user identity vector. The vector can be an array or object containing various identity attributes of the user. The user identity vector is authenticated. The real identity of the user is confirmed by verifying the information in the user identity vector, such as verifying the correctness of the user name and password, checking the validity of the token, etc. The request resource information is extracted according to the request format data. The request resource information usually includes the specific resources that the user wants to access, such as files, data tables, or API endpoints. By parsing the resource fields in the request format data, the request resource information is extracted to form a resource identification vector. This vector represents the unique identification of the resource requested by the user. The corresponding resource is searched in the resource list according to the resource identification vector. The resource list is a list of all accessible resources in the system. By searching the resource identification vector in the resource list, the specific resource pointed to by the request is confirmed and the requested resource is obtained. The access type information is extracted according to the request format data. The access type information describes the type of operation of the user on the resource, such as read, write, delete, etc. The access type information is extracted by parsing the operation field in the request format data to obtain the access type code. The request parsing vector is constructed according to the user identity, the requested resource and the access type code. The vector integrates all key information of the user identity, the requested resource and the access type. Feature extraction is performed on the request parsing vector. The effective information that can reflect the data characteristics is extracted from the original data to obtain the request feature vector. The request parsing vector is classified according to the request feature vector. The request parsing vector is classified into predefined access types, such as read request, write request, etc. Classification can be achieved through a machine learning model, such as using a decision tree, a support vector machine or a neural network. The result of the classification is an access type, which indicates the specific operation category of the request. The request parsing vector is stored in the request data queue according to the access type. The request data queue is a buffer for the system to process requests. By storing the request parsing vector in the queue, the request queuing and scheduling processing are realized. This ensures that the system can process user requests in sequence according to priority and processing capacity, improving the system's response efficiency and reliability.

[0134] In a specific embodiment, the process of executing step S103 may specifically include the following steps:

[0135] (1) Standardize the policy formats of multiple local access control policies in a multi-domain environment to obtain a standardized policy set;

[0136] (2) extracting policy elements according to the standardized policy set to obtain a policy element set;

[0137] (3) De-duplication of the policy element set is performed to obtain a unique policy element set;

[0138] (4) constructing a policy element relationship matrix based on the unique policy element set;

[0139] (5) Performing principal component analysis on the strategy element relationship matrix to obtain a set of principal component vectors;

[0140] (6) performing dimensionality reduction processing on the unique strategy element set according to the principal component vector set to obtain a low-dimensional strategy element set;

[0141] (7) construct the objective function and constraints of the integer linear programming model based on the set of low-dimensional strategy elements;

[0142] (8) converting the integer linear programming model into a standard form to obtain a standard integer linear programming model;

[0143] (9) Solve the standard integer linear programming model to obtain a solution vector;

[0144] (10) Reconstruct the fused access control policy according to the solution vector to obtain the global access control policy.

[0145] Specifically, the policy formats of multiple local access control policies in a multi-domain environment are standardized. Since the access control policies of different domains may have different formats and representation methods, these policies need to be converted into a unified standard format. The implementation of a standardized policy set can be achieved by defining a common policy template and converting each local policy into a form that conforms to the template. For example, for an access control policy, it can be standardized into a triple (user, resource, permission), where the user represents the subject of the access request, the resource represents the object to be accessed, and the permission represents the type of operation allowed. Extract policy elements according to the standardized policy set. Policy elements are the basic components of access control policies, including users, resources, and permissions. By traversing the standardized policy set, all policy elements are extracted to form a policy element set. De-duplicate the policy element set. Since the same policy elements may appear in different policies, the policy element set is de-duplicated to ensure that each policy element exists uniquely in the set. For example, a hash table is used to quickly find and delete duplicate elements, and after de-duplication, a unique policy element set is obtained. A policy element relationship matrix is ​​constructed according to the unique policy element set. The relationship matrix is ​​used to represent the association between policy elements, such as the access relationship between users and resources. The strength of the relationship can be determined by counting the number of co-occurrences of policy elements in the policy. For example, if a user and a resource appear in multiple policies at the same time, the strength of their relationship is high. Perform principal component analysis on the policy element relationship matrix. Principal component analysis is a dimensionality reduction technique used to extract the main features in the data and reduce the dimension of the data. By performing principal component analysis on the relationship matrix, a set of principal component vectors is obtained. The set of unique policy elements is reduced in dimension according to the set of principal component vectors to reduce the dimension of the data while retaining the main information in the data. Construct the objective function and constraints of the integer linear programming model based on the low-dimensional policy element set. The goal of the integer linear programming model is to optimize the access control policy to ensure that a specific optimization goal is achieved while satisfying the constraints. The objective function can be defined as maximizing the consistency of the policy or minimizing the policy conflict, etc. Assume that the objective function is Z, expressed as:

[0146]

[0147] Among them, c ij Represents the policy element E i and E j The strength of the relationship between ij is a decision variable, indicating whether to select strategy element E i and E jrelationship. Convert the integer linear programming model into a standard form. The standard integer linear programming model includes standard representations of the objective function and constraints, which are converted into a standard form through mathematical transformation. For example, the model is converted into a standard form by adding slack variables or introducing the big M method. Solve the standard integer linear programming model. The solution process can use optimization algorithms such as the simplex method, branch and bound method, or genetic algorithm. By solving the standard integer linear programming model, a solution vector is obtained. The solution vector represents the optimal solution of the optimization model, including a specific combination of policy elements. Reconstruct the fused access control policy based on the solution vector. Convert the information in the solution vector into specific access control rules to form the final global access control policy.

[0148] In a specific embodiment, the process of executing step S104 may specifically include the following steps:

[0149] (1) Perform policy semantic analysis on the global access control policy to obtain a policy semantic tree;

[0150] (2) Extracting a set of policy rules based on the policy semantic tree;

[0151] (3) Perform rule conflict detection on the policy rule set to obtain a set of conflicting rule pairs;

[0152] (4) construct a rule conflict graph based on the conflict rules;

[0153] (5) Calculate the minimum point cover set on the rule conflict graph to obtain the minimum conflict rule set;

[0154] (6) Modify the rules of the global access control policy according to the minimum conflict rule set to obtain a modified policy;

[0155] (7) Performing policy consistency verification on the revised policy to obtain a consistency verification result;

[0156] (8) Optimizing the revised strategy based on the consistency verification result to obtain the optimized strategy;

[0157] (10) Calculating the policy security metric value of the optimized policy to obtain a security metric value;

[0158] (11) Generate a security assessment report based on the security metrics.

[0159] Specifically, the global access control policy is semantically parsed to understand the logical structure and meaning of the policy and form a policy semantic tree. The policy semantic tree is a hierarchical structure that represents the various components of the policy and their interrelationships. By parsing the various elements of the policy, such as subjects, resources, and operations, and converting them into a tree structure, the policy can be better understood and processed. The policy rule set is extracted according to the policy semantic tree. The policy rule is the basic operation unit of the policy and describes whether a subject is allowed or denied to operate on a resource under specific conditions. By traversing the policy semantic tree, all policy rules are extracted to form a policy rule set. The policy rule set is tested for rule conflicts. Rule conflict refers to the contradictory or inconsistent behavior of two or more rules under certain conditions. For example, one rule allows a user to read a resource, while another rule prohibits the same user from reading the same resource. By analyzing the rule set, all conflicting rule pairs are detected and marked to form a conflict rule pair set. A rule conflict graph is constructed according to the conflict rule pair set. The rule conflict graph is a graph structure in which nodes represent policy rules and edges represent conflict relationships between rules. By mapping conflict rule pairs to edges in the graph, the conflict between rules can be intuitively displayed. Calculate the minimum point cover set for the rule conflict graph. The minimum point cover set refers to selecting the minimum number of nodes in the graph so that all edges in the graph are connected to at least one of these nodes. By calculating the minimum point cover set, the minimum number of conflicting rules is found, so as to minimize the impact of conflicts on the system without destroying the overall policy structure. Modify the rules of the global access control policy according to the minimum conflict rule set to eliminate or reduce rule conflicts and ensure the consistency and security of the policy. The modified policy is obtained by adjusting or deleting the rules in the minimum conflict rule set. Verify the policy consistency of the modified policy. Check the logical relationship and consistency in the policy through consistency verification tools or methods to obtain consistency verification results. If new conflicts or inconsistencies are found, the policy needs to be further adjusted and corrected. Optimize the revised policy according to the consistency verification results to improve the execution efficiency and security performance of the policy. Simplify and optimize the policy through optimization algorithms or technologies, such as logic simplification and rule merging, to obtain the optimized policy. Calculate the policy security metric for the optimized policy. The policy security metric is used to evaluate the quantitative indicators of policy security. Calculate the security metrics of the optimized strategy through security metrics models or tools, such as coverage, redundancy, and conflict rate, etc. Generate a security assessment report based on the security metrics.

[0160] In a specific embodiment, the process of executing step S105 may specifically include the following steps:

[0161] (1) Analyze the report structure of the safety assessment report to obtain a set of report elements;

[0162] (2) extracting strategy optimization suggestions based on the report element set to obtain an optimization suggestion set;

[0163] (3) Classifying the optimization suggestion set to obtain a classified suggestion set;

[0164] (4) construct an optimized decision tree based on the classification suggestion set;

[0165] (5) Extracting policy elements from the global access control policy to obtain a policy element set;

[0166] (6) Optimizing the strategy element set according to the optimization decision tree to obtain an optimized strategy element set;

[0167] (7) constructing the strategy semantics of the optimization strategy element set to obtain the optimization strategy semantic model;

[0168] (8) Generate the original text of the target access control policy based on the optimized policy semantic model;

[0169] (9) Formatting the target access control policy original text to obtain a formatted policy text;

[0170] (10) Update the policy library according to the formatted policy text to obtain the target access control policy.

[0171] Specifically, the security assessment report is analyzed for its structure. The security assessment report usually contains multiple parts, such as risk analysis, security metrics, existing policy evaluation, and improvement suggestions. Through the analysis of the report structure, these different parts are extracted to form a set of report elements. Policy optimization suggestions are extracted based on the set of report elements. Optimization suggestions usually include reducing rule conflicts, improving policy efficiency, and increasing policy coverage. The set of optimization suggestions is classified. Optimization suggestions can be classified according to their nature and goals, such as suggestions for reducing conflicts, suggestions for improving efficiency, and suggestions for increasing coverage. By classifying the optimization suggestions, a set of classified suggestions is formed. An optimization decision tree is constructed based on the set of classified suggestions. An optimization decision tree is a decision support tool used to guide the process of policy optimization. By constructing the classified suggestions into a decision tree structure according to logical relationships and priorities, the decision path and priority order in the optimization process are intuitively represented. The optimization decision tree can help identify the optimal optimization path and ensure that all key suggestions are effectively processed. Policy elements are extracted for the global access control policy. Policy elements are the basic components of the access control policy, including users, resources, operation types, conditions, etc. By analyzing the existing global access control policy, all policy elements are extracted to form a policy element set. The policy element set is optimized according to the optimization decision tree. The purpose of the optimization decision is to adjust and improve the policy elements on the basis of following the optimization suggestions to form an optimized policy element set. By applying the decision path and priority in the optimization decision tree, each element in the policy element set is systematically processed to ensure the comprehensiveness and effectiveness of the optimization process. The policy semantics of the optimized policy element set is constructed. The optimized policy elements are converted into a structured policy semantic model to ensure the semantic consistency and logic of the optimized policy. The policy semantic model is a hierarchical structure that represents the various components of the policy and their relationships. The target access control policy original text is generated according to the optimized policy semantic model. The target access control policy original text is formatted. The policy text is typeset and adjusted according to the preset standards and formats to obtain the formatted policy text. The policy library is updated according to the formatted policy text. The policy library is a database that stores all access control policies in the system. By adding the new target access control policy to the policy library, it is ensured that the system uses the latest policy in actual applications to obtain the target access control policy.

[0172] In a specific embodiment, the process of executing step S106 may specifically include the following steps:

[0173] (1) Deploy the target access control policy to obtain a deployment policy set;

[0174] (2) deploying corresponding policy agents on multiple data terminals according to the deployment policy set;

[0175] (3) The policy agent intercepts the access request of the terminal and obtains interception request data;

[0176] (4) Make access decisions on the intercepted request data according to the target access control policy and obtain access decision results;

[0177] (5) Perform corresponding access control operations on the intercepted request data according to the access decision result to obtain an access control log;

[0178] (6) The policy agent monitors the system status of the terminal and obtains system status data;

[0179] (7) Generate local monitoring reports based on access control logs and system status data;

[0180] (8) The policy agent uploads the local monitoring report to the monitoring center;

[0181] (9) The monitoring center performs data fusion on all received local monitoring reports to obtain a global monitoring data set;

[0182] (10) Generate a monitoring status report based on the global monitoring data set, where the monitoring status report includes: terminal security status data and terminal access behavior data.

[0183] Specifically, the target access control policy is deployed, and the target access control policy is converted into specific execution steps and rules. By analyzing the content of the target access control policy, a deployment policy set is generated. The set contains all components and execution instructions of the policy, ensuring that each data terminal can execute the policy according to a unified standard. According to the deployment policy set, corresponding policy agents are deployed on multiple data terminals. By installing and configuring the policy agent on each data terminal, it can receive and execute the instructions in the deployment policy set. The policy agent intercepts the access request of the terminal. By real-time monitoring of all access activities on the terminal, each access request is captured and recorded to obtain interception request data. The interception request data includes information such as the subject, resource, operation type and time of the access request. Access decisions are made on the interception request data according to the target access control policy. The policy agent uses predefined access control rules to analyze and judge the interception request data to decide whether to allow, deny or restrict the access request. The access decision result is based on the rules and logic of the target access control policy, and a specific decision result is generated by comparing the request data with the policy rules. According to the access decision result, corresponding access control operations are performed on the interception request data. Access control operations include allowing requests, denying requests, or restricting requests. The process of executing access control operations requires recording the processing results of each request to form an access control log. The policy agent monitors the system status of the terminal. The policy agent obtains system status data by collecting and recording various status data of the terminal in real time, such as CPU usage, memory usage, network traffic, etc. These data can help identify potential security threats and system failures. A local monitoring report is generated based on the access control log and system status data. The monitoring report combines the access behavior and system status of the terminal. The policy agent uploads the local monitoring report to the monitoring center. The monitoring center is the core platform for system security management. It forms a global monitoring data set by collecting and analyzing the monitoring reports uploaded by each terminal. The monitoring center performs data fusion on all received local monitoring reports. The monitoring data from different terminals is integrated and analyzed, redundant information is eliminated, key information is extracted, and a global monitoring data set is obtained. A monitoring status report is generated based on the global monitoring data set. The monitoring status report is a summary and analysis of the global monitoring data, including the security status data and access behavior data of the terminal.

[0184] The above describes the method for processing secure access in the embodiment of the present application. The following describes the device for processing secure access in the embodiment of the present application. Figure 2 In one embodiment of the present application, a processing device for secure access includes:

[0185] Processing module 201 is used to initialize the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix;

[0186] The parsing module 202 is used to parse the received user access request to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and classify the request parsing data to obtain a request data queue;

[0187] A merging module 203 is used to merge multiple local access control policies in a multi-domain environment to obtain a fused access control policy, construct an integer linear programming model according to the fused access control policy, and solve the integer linear programming model to obtain a global access control policy;

[0188] An evaluation module 204 is used to perform a security evaluation on the global access control policy to obtain a security evaluation report;

[0189] An updating module 205 is used to update the global access control policy through the security assessment report to obtain a target access control policy;

[0190] The monitoring module 206 is used to continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

[0191] Through the collaboration of the above components, the efficiency of data initialization processing is improved by extracting and classifying the features of multimodal resource data, generating resource feature vector sets and resource category sets. The resource tree structure and domain hierarchical model are constructed to achieve orderly organization of resources and domains, which is convenient for the subsequent access control policy formulation. The accuracy and legitimacy of user identity are ensured through request format parsing and user identity authentication. The request resource information and access type information are extracted, the request parsing vector is constructed, the user access request is accurately classified, and the request data queue is formed for subsequent processing. The policy format standardization and policy element deduplication are adopted to ensure the effective integration of local access control policies in multi-domain environments. The policy element set is simplified through principal component analysis and dimensionality reduction processing, the complexity of policy merging is reduced, and the generation efficiency of global access control policies is improved. The global access control policy is parsed for policy semantics and rule conflict detection is performed to ensure the correctness and consistency of policy rules. Through the rule conflict graph and the minimum point covering set calculation, the potential conflicting rules are discovered and corrected, which improves the security and reliability of the policy. Optimization suggestions are extracted based on the security assessment report, and the global access control policy is updated by optimizing the decision tree to generate the target access control policy. Dynamic optimization and real-time updating of policies are achieved, ensuring the adaptability and effectiveness of access control policies. By deploying policy agents on multiple data terminals, access requests are intercepted and processed in real time, generating access control logs and system status data. Local monitoring reports are integrated to generate global monitoring data sets and monitoring status reports, providing comprehensive terminal security status and access behavior data, and enhancing the system's security monitoring capabilities.

[0192] The present application also provides a secure access processing device, which includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the secure access processing method in the above-mentioned embodiments.

[0193] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium, and when the instructions are executed on a computer, the computer executes the steps of the security access processing method.

[0194] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0195] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0196] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for processing secure access, characterized in that: The security access processing method includes: Initialize the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix; specifically include: extracting features from the multimodal resource data to obtain a resource feature vector set; clustering the multimodal resource data according to the resource feature vector set to obtain a resource category set; encoding the resource category set to obtain a resource coding vector set; constructing a resource tree structure according to the resource coding vector set to obtain a resource hierarchy model; modeling the inter-domain relationship of the data domain set to obtain a domain relationship matrix; classifying the data domain set according to the domain relationship matrix to obtain a domain category set; encoding the domain category set to obtain a domain coding vector set; constructing a domain tree structure according to the domain coding vector set to obtain a domain hierarchy model; constructing a resource-domain mapping relationship according to the resource hierarchy model and the domain hierarchy model to obtain a resource list; generating an access control policy matrix according to the resource list and preset access control rules; Parsing the received user access request to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and classifying the request parsing data to obtain a request data queue; Merge multiple local access control policies in a multi-domain environment to obtain a fused access control policy, construct an integer linear programming model based on the fused access control policy, and solve the integer linear programming model to obtain a global access control policy; specifically include: standardize the policy format of multiple local access control policies in the multi-domain environment to obtain a standardized policy set; extract policy elements based on the standardized policy set to obtain a policy element set; deduplicate the policy element set to obtain a unique policy element set; construct a policy element relationship matrix based on the unique policy element set; perform principal component analysis on the policy element relationship matrix to obtain a principal component vector set; perform dimensionality reduction on the unique policy element set based on the principal component vector set to obtain a low-dimensional policy element set; construct the objective function and constraint conditions of the integer linear programming model based on the low-dimensional policy element set; convert the integer linear programming model into a standard form to obtain a standard integer linear programming model; solve the standard integer linear programming model to obtain a solution vector; reconstruct the fused access control policy based on the solution vector to obtain a global access control policy; Performing a security assessment on the global access control policy to obtain a security assessment report; The global access control policy is updated through the security assessment report to obtain a target access control policy; Continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy, and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

2. The method for processing secure access according to claim 1, characterized in that: The received user access request is parsed to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and the request parsing data is classified to obtain a request data queue, including: Parsing the user access request in a request format to obtain request format data; Extracting user identity information according to the request format data to obtain a user identity vector; Authentication is performed on the user identity vector to obtain a user identity; Extracting the requested resource information according to the request format data to obtain a resource identification vector; Searching for a corresponding resource in the resource list according to the resource identification vector to obtain the requested resource; Extracting access type information according to the request format data to obtain an access type code; constructing a request parsing vector according to the user identity, the requested resource and the access type code; Performing feature extraction on the request parsing vector to obtain a request feature vector; Classifying the request parsing vector according to the request feature vector to obtain an access type; The request parsing vector is stored in a request data queue according to the access type.

3. The method for processing secure access according to claim 1, characterized in that: The security assessment of the global access control policy is performed to obtain a security assessment report, including: Performing policy semantic analysis on the global access control policy to obtain a policy semantic tree; Extracting a set of policy rules according to the policy semantic tree; Performing rule conflict detection on the policy rule set to obtain a set of conflicting rule pairs; Constructing a rule conflict graph according to the set of conflicting rules; Calculating the minimum point cover set on the rule conflict graph to obtain a minimum conflict rule set; Modifying the global access control policy according to the minimum conflict rule set to obtain a modified policy; Performing policy consistency verification on the revised policy to obtain a consistency verification result; Performing strategy optimization on the revised strategy according to the consistency verification result to obtain an optimized strategy; Calculating the policy security metric value for the optimized policy to obtain a security metric value; A security assessment report is generated according to the security metric value.

4. The method for processing secure access according to claim 1, characterized in that: The updating of the global access control policy through the security assessment report to obtain a target access control policy includes: Performing report structure analysis on the safety assessment report to obtain a report element set; Extracting strategy optimization suggestions according to the report element set to obtain an optimization suggestion set; Classifying the optimization suggestion set to obtain a classified suggestion set; Constructing an optimized decision tree according to the classification suggestion set; Extracting policy elements from the global access control policy to obtain a policy element set; Performing optimization decision on the strategy element set according to the optimization decision tree to obtain an optimized strategy element set; Performing strategy semantic construction on the optimization strategy element set to obtain an optimization strategy semantic model; Generate a target access control policy original text according to the optimized policy semantic model; Performing policy formatting on the target access control policy original text to obtain a formatted policy text; The policy library is updated according to the formatted policy text to obtain the target access control policy.

5. The method for processing secure access according to claim 1, characterized in that: The method of continuously monitoring a plurality of data terminals in the multi-domain environment according to the target access control policy and generating a monitoring status report includes: terminal security status data and terminal access behavior data, including: Performing policy deployment on the target access control policy to obtain a deployment policy set; Deploy corresponding policy agents on the multiple data terminals according to the deployment policy set; The policy agent intercepts the access request of the terminal and obtains interception request data; Performing access decision on the intercept request data according to the target access control policy to obtain an access decision result; Perform corresponding access control operations on the intercept request data according to the access decision result to obtain an access control log; The policy agent monitors the system status of the terminal to obtain system status data; generating a local monitoring report based on the access control log and the system status data; The policy agent uploads the local monitoring report to the monitoring center; The monitoring center performs data fusion on all received local monitoring reports to obtain a global monitoring data set; A monitoring status report is generated according to the global monitoring data set, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

6. A secure access processing device, characterized in that: The secure access processing device comprises: A processing module is used to initialize the acquired multimodal resource data and data domain set to obtain a resource list and an access control policy matrix; specifically comprising: extracting features from the multimodal resource data to obtain a resource feature vector set; clustering the multimodal resource data according to the resource feature vector set to obtain a resource category set; encoding the resource category set to obtain a resource encoding vector set; constructing a resource tree structure according to the resource encoding vector set to obtain a resource hierarchy model; modeling the inter-domain relationship of the data domain set to obtain a domain relationship matrix; classifying the data domain set according to the domain relationship matrix to obtain a domain category set; encoding the domain category set to obtain a domain encoding vector set; constructing a domain tree structure according to the domain encoding vector set to obtain a domain hierarchy model; constructing a resource-domain mapping relationship according to the resource hierarchy model and the domain hierarchy model to obtain a resource list; generating an access control policy matrix according to the resource list and preset access control rules; A parsing module, configured to parse the received user access request to obtain request parsing data, wherein the request parsing data includes: user identity, requested resource and access type, and classify the request parsing data to obtain a request data queue; A merging module is used to merge multiple local access control policies in a multi-domain environment to obtain a fused access control policy, construct an integer linear programming model based on the fused access control policy, and solve the integer linear programming model to obtain a global access control policy; specifically includes: performing policy format standardization processing on multiple local access control policies in the multi-domain environment to obtain a standardized policy set; extracting policy elements based on the standardized policy set to obtain a policy element set; deduplicating the policy element set to obtain a unique policy element set; constructing a policy element relationship matrix based on the unique policy element set; performing principal component analysis on the policy element relationship matrix to obtain a principal component vector set; performing dimensionality reduction processing on the unique policy element set based on the principal component vector set to obtain a low-dimensional policy element set; constructing the objective function and constraint conditions of the integer linear programming model based on the low-dimensional policy element set; converting the integer linear programming model into a standard form to obtain a standard integer linear programming model; solving the standard integer linear programming model to obtain a solution vector; reconstructing the fused access control policy based on the solution vector to obtain a global access control policy; An evaluation module, used to perform a security evaluation on the global access control policy and obtain a security evaluation report; An updating module, used to update the global access control policy through the security assessment report to obtain a target access control policy; The monitoring module is used to continuously monitor multiple data terminals in the multi-domain environment according to the target access control policy and generate a monitoring status report, wherein the monitoring status report includes: terminal security status data and terminal access behavior data.

7. A secure access processing device, characterized in that: The secure access processing device includes: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instruction in the memory to enable the secure access processing device to execute the secure access processing method according to any one of claims 1 to 5.

8. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by a processor, a secure access processing method as described in any one of claims 1 to 5 is implemented.

Images