Access control method, electronic device and storage medium

Abstract

The present invention provides an access control method, an electronic device and a storage medium, which relate to the technical field of network security, and include the following steps: receiving a target access request corresponding to a target login account, when the target login account is an abnormal account, rejecting the target access request to deny access to a target database by a user controlling the target login account, when the target login account is a non-abnormal account, obtaining a target priority, setting different verification information for the target login account according to different target priorities, obtaining a target accuracy rate corresponding to the target login account, when the target accuracy rate is 1, implementing access to the target database by a user controlling the target login account through a target access request, the present invention implements different access control methods based on the importance of the database, improves the efficiency of access control, sets verification information corresponding to the user based on an LLM model, and screens the verification information, so that the accuracy of access control is high.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an access control method, electronic equipment and storage medium. Background Art

[0002] With the rapid development of information technology, the application scope of computer systems and network resources is expanding, and more and more key data are stored in various databases and network systems. At the same time, in the era of continuous updates in the Internet era, network attack methods are becoming increasingly diverse, and there is a risk of data leakage and illegal access. In order to ensure information security, many databases and application systems should be equipped with access control strategies to effectively control access rights to database resources.

[0003] The access control method in the prior art is to perform access control based on roles, assign permissions to roles, implement permission management based on user roles to access the database, use machine learning models to perform real-time learning and adjustment based on user behaviors and patterns, and use algorithms to learn user behaviors. In the process of using algorithms to select algorithms and the quality of training data, high requirements are placed on the quality of training data, and misjudgments may occur. At the same time, different access control methods are not implemented based on the importance of the database, resulting in low efficiency of access control. The verification information corresponding to the user is not considered to be set based on the LLM model, and the verification information is not screened, which reduces the accuracy of obtaining authorized users and results in low accuracy of access control. Summary of the invention

[0004] In view of the above technical problems, the technical solution adopted by the present invention is: an access control method, comprising the following steps:

[0005] S100, receiving a target access request corresponding to a target login account, wherein the target login account is an account that requests to log in to a target database and establish a connection access with the target database.

[0006] S200, when the target login account is an abnormal account, reject the target access request to deny the user who controls the target login account from accessing the target database.

[0007] S300, when the target login account is a normal account, obtaining a target priority corresponding to the target database, wherein the target priority is a security level of the target database obtained based on the importance of the target database.

[0008] S400, when the target priority is the first target level, setting first verification information for the target login account.

[0009] S500, when the target priority is a second target level, setting second verification information for the target login account.

[0010] S600, when the target priority is the third target level, setting third verification information for the target login account.

[0011] S700, obtaining a target accuracy rate corresponding to a target login account, wherein the target accuracy rate is an accuracy rate of a user controlling the target login account to answer target verification information, and the target verification information is the first verification information, the second verification information, or the third verification information.

[0012] S800, when the target accuracy is 1, a target access request is used to control the user of the target login account to access the target database.

[0013] The present invention also provides a non-transitory computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned access control method.

[0014] The present invention also provides an electronic device, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0015] The present invention has at least the following beneficial effects: an access control method, comprising the following steps: receiving a target access request corresponding to a target login account; when the target login account is an abnormal account, rejecting the target access request to deny the user controlling the target login account from accessing the target database; when the target login account is a non-abnormal account, obtaining the target priority corresponding to the target database; when the target priority is a first target level, setting first verification information for the target login account; when the target priority is a second target level, setting second verification information for the target login account; when the target priority is a third target level, setting third verification information for the target login account; obtaining the target accuracy corresponding to the target login account, wherein the target accuracy is the accuracy of the user controlling the target login account answering the target verification information; the target verification information is the first verification information or the second verification information or the third verification information; when the target accuracy is 1, implementing the target access request to enable the user controlling the target login account to access the target database; the present invention implements different access control methods based on the importance of the database, improves the efficiency of access control, sets the verification information corresponding to the user based on the LLM model, screens the verification information, ensures that the verification information is not cracked, and makes the access control more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A flowchart of an access control method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0019] Example

[0020] This embodiment provides an access control method, including the following steps: Figure 1 As shown:

[0021] S100, receiving a target access request corresponding to a target login account, wherein the target login account is an account that requests to log in to a target database and establish a connection access with the target database.

[0022] Specifically, the target database is a database that stores data for providing data to users.

[0023] Specifically, the target access request is a request for a target login account to establish a connection access to a target database.

[0024] S200, when the target login account is an abnormal account, reject the target access request to deny the user who controls the target login account from accessing the target database.

[0025] Specifically, the abnormal account is an account that does not have permission to access the target database.

[0026] S300, when the target login account is a normal account, obtaining the target priority corresponding to the target database.

[0027] Specifically, the target priority is a security level of the target database obtained based on the importance of the target database.

[0028] Furthermore, when the target priority is higher, the security level of the target database is higher, and the number of accounts with permission to access the target database is smaller.

[0029] S400, when the target priority is the first target level, setting first verification information for the target login account.

[0030] Specifically, the first target level is a low security level, which can be understood as: dividing the security level of the database into three levels: low, medium and high. Among them, those skilled in the art know that any method of dividing the security level of the database in the prior art falls within the protection scope of the present invention and will not be repeated here.

[0031] Specifically, the first verification information is the password corresponding to the target login account and the verification code of the device corresponding to the target login account.

[0032] S500, when the target priority is a second target level, setting second verification information for the target login account.

[0033] Specifically, the second target level is a medium security level.

[0034] Specifically, in S500, the second verification information is obtained through the following steps:

[0035] S501, obtaining a set of verification problems to be selected, wherein the set of verification problems to be selected includes a plurality of verification problems to be selected.

[0036] Specifically, S501 also includes the following steps:

[0037] S5011, obtaining a first sample verification question set, wherein the first sample verification question set includes a plurality of first sample verification questions, and the first sample verification questions are verification questions obtained from a specified database.

[0038] Specifically, the designated database stores several verification questions, wherein those skilled in the art know that verification questions can be set according to actual needs to form a designated database, all of which fall within the protection scope of the present invention and will not be described in detail here.

[0039] Furthermore, the verification question is a question used to verify the login authority of the login account.

[0040] S5012, obtaining a second sample verification problem set according to the first sample verification problem set, wherein the second sample verification problem set includes a plurality of second sample verification problems, and the second sample verification problems are verification problems obtained by expanding the first preset LLM model based on the first sample verification problem set.

[0041] Specifically, those skilled in the art know that any process of performing the first preset LLM model training in the prior art falls within the protection scope of the present invention and will not be described in detail herein.

[0042] S5013, determining a first candidate verification question set based on the second sample verification question set, wherein the first candidate verification question set includes a plurality of first candidate verification questions, and the first candidate verification questions are second sample verification questions obtained by screening the second sample verification questions in the second sample verification question set.

[0043] Specifically, S5013 also includes the following steps:

[0044] S1, obtain a sample account ID list and a target verification question list set corresponding to the sample account ID list.

[0045] Specifically, the sample account ID list includes a number of sample accounts, wherein the sample accounts are login accounts that have the permission to register and access the target database.

[0046] Specifically, the target verification question list set includes several target verification question lists, wherein each sample account ID corresponds to a target verification question list, and the target verification question list includes several target verification questions.

[0047] Furthermore, the target verification question is a question that the sample account corresponding to the sample account ID needs to fill in when registering.

[0048] Furthermore, the target verification problem is obtained by obtaining a second sample verification problem from a second sample verification problem set.

[0049] Furthermore, the number of target verification questions in each target verification question list is consistent with the number of second sample verification questions in the second sample verification question set.

[0050] S2, obtain the sample priority set H={H1, ..., H i , ..., H n}, H i is the sample priority corresponding to the i-th second sample verification problem, i=1…n, n is the number of second sample verification problems in the second sample verification problem set, where H i Meet the following conditions:

[0051] H i =1-α i / β, β is the number of sample account IDs in the sample account ID list, α i is the number of sample account IDs in the sample account ID list whose answers to the i-th second sample verification question are empty.

[0052] S3, when H i ≥H 0 When H iThe corresponding second sample verification problem is the first candidate verification problem set, where H 0 is the preset sample priority threshold.

[0053] Specifically, H 0 The value range of H is 0.6 to 0.8, wherein those skilled in the art know that H can be adjusted according to actual needs. 0 The selection of all falls within the protection scope of the present invention and will not be repeated here.

[0054] S5014, obtaining a second candidate verification problem set according to the first candidate verification problem set, wherein the second candidate verification problem set includes Q second candidate verification problems, and the second candidate verification problems are first candidate verification problems randomly obtained from the first candidate verification problem set, wherein Q meets the following conditions:

[0055] , P is the number of times the target database is accessed within a preset time period, K is the number of second candidate verification problems randomly selected from the second candidate verification problem set, and Q is the number of second candidate verification problems in the second candidate verification problem set.

[0056] Specifically, the end time corresponding to the preset time period is the current moment, wherein the time span corresponding to the preset time period is 7 to 14 days. Those skilled in the art know that the time span corresponding to the preset time period can be selected according to actual needs, which falls within the protection scope of the present invention and will not be repeated here.

[0057] Specifically, the value of K is 2 or 3. Those skilled in the art know that K can be selected according to actual needs, which falls within the protection scope of the present invention and will not be described in detail here.

[0058] S5015, K second candidate verification problems randomly selected from the second candidate verification problem set constitute a verification problem set to be selected.

[0059] In the above, the verification information corresponding to the user is set based on the LLM model, and the verification information is screened to ensure that the verification information is not cracked, so that the accuracy of access control is higher.

[0060] S502, obtaining first verification information, wherein the first verification information is a password corresponding to the target login account and a verification code of a device corresponding to the target login account.

[0061] S503: Acquire second verification information according to the first verification information and the set of verification questions to be selected, wherein the second verification information includes the first verification information and the set of verification questions to be selected.

[0062] Specifically, it can be understood that the second verification information includes the password corresponding to the target login account, the verification code of the device corresponding to the target login account, and K verification questions in the set of verification questions. When the user logs in to the account, he needs to answer the questions included in the second verification information.

[0063] S600, when the target priority is the third target level, setting third verification information for the target login account.

[0064] Specifically, the third target level is a high security level.

[0065] Furthermore, when the security level is higher, the number of accounts with the authority to access the corresponding database is smaller, and the verification information for the accounts with the authority to access the corresponding data is more complicated.

[0066] Specifically, in S600, the third verification information is obtained through the following steps:

[0067] S601, obtaining first verification information, wherein the first verification information is a password corresponding to a target login account and a verification code of a device corresponding to the target login account.

[0068] S602, obtaining a set of verification problems to be selected, wherein the set of verification problems to be selected includes K verification problems to be selected.

[0069] Specifically, the method for obtaining the set of verification problems to be selected in S601 is consistent with the method for obtaining the set of verification problems to be selected in S501, and can refer to steps S5011 to S5015.

[0070] S603, obtaining a target feature information set, wherein the target feature information set includes a plurality of target feature information, and the target feature information is feature information corresponding to the target data.

[0071] Specifically, the target data is data related to the behavior track of the user who controls the target login account and transmitted to the target database through the SDK.

[0072] Specifically, the feature information is information describing features corresponding to the target data obtained by performing feature extraction on the target data. Those skilled in the art know that any method for extracting data features in the prior art falls within the protection scope of the present invention and will not be described in detail herein.

[0073] S604, input the target feature information set into the second preset LLM model to obtain a key verification question set, wherein the key verification question set includes a plurality of key verification questions, and the key verification questions are verification questions generated by the second preset LLM model based on the target feature information set.

[0074] S605 , obtaining a specified verification question set according to the key verification question set, wherein the specified verification question set includes N specified verification questions, and the specified verification questions are key verification questions randomly obtained from the key verification question set.

[0075] Specifically, N is the number of specified verification problems in the specified verification problem set, and N meets the following conditions:

[0076] N=ZK, Z is a preset constant.

[0077] Specifically, the value range of Z is 6 to 8, wherein those skilled in the art know that Z can be selected according to actual needs, all of which fall within the protection scope of the present invention and will not be described in detail here.

[0078] S606, obtaining third verification information, wherein the third verification information includes the first verification information, a set of to-be-selected verification questions, and a set of specified verification questions.

[0079] As described above, different access control methods are implemented based on the importance of the database, and different verification information is set, thereby improving the efficiency of access control.

[0080] S700, obtaining a target accuracy rate corresponding to a target login account, wherein the target accuracy rate is the accuracy rate of a user controlling the target login account to answer target verification information.

[0081] Specifically, the target verification information is the first verification information, the second verification information, or the third verification information.

[0082] Specifically, the accuracy rate is the ratio of the number of correct answers to the verification questions to the number of all the verification questions.

[0083] S800, when the target accuracy is 1, a target access request is used to control the user of the target login account to access the target database.

[0084] An access control method provided by the present embodiment includes the following steps: receiving a target access request corresponding to a target login account; when the target login account is an abnormal account, rejecting the target access request to deny the user controlling the target login account from accessing the target database; when the target login account is a non-abnormal account, obtaining the target priority corresponding to the target database; when the target priority is a first target level, setting first verification information for the target login account; when the target priority is a second target level, setting second verification information for the target login account; when the target priority is a third target level, setting third verification information for the target login account; obtaining the target accuracy corresponding to the target login account, wherein the target accuracy is the accuracy of the user controlling the target login account answering the target verification information; the target verification information is the first verification information or the second verification information or the third verification information; when the target accuracy is 1, implementing the target access request to enable the user controlling the target login account to access the target database; the present embodiment implements different access control methods based on the importance of the database, thereby improving the efficiency of access control; setting the verification information corresponding to the user based on the LLM model, screening the verification information, ensuring that the verification information is not cracked, and making the access control more accurate.

[0085] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one readable instruction or at least one program related to implementing a method in a method embodiment, and the at least one readable instruction or the at least one program is loaded and executed by the processor to implement:

[0086] S100, receiving a target access request corresponding to a target login account, wherein the target login account is an account that requests to log in to a target database and establish a connection access with the target database.

[0087] S200, when the target login account is an abnormal account, reject the target access request to deny the user who controls the target login account from accessing the target database.

[0088] S300, when the target login account is a normal account, obtaining a target priority corresponding to the target database, wherein the target priority is a security level of the target database obtained based on the importance of the target database.

[0089] S400, when the target priority is the first target level, setting first verification information for the target login account.

[0090] S500, when the target priority is a second target level, setting second verification information for the target login account.

[0091] S600, when the target priority is the third target level, setting third verification information for the target login account.

[0092] S700, obtaining a target accuracy rate corresponding to a target login account, wherein the target accuracy rate is an accuracy rate of a user controlling the target login account to answer target verification information, and the target verification information is the first verification information, the second verification information, or the third verification information.

[0093] S800, when the target accuracy is 1, a target access request is used to control the user of the target login account to access the target database.

[0094] An embodiment of the present invention further provides an electronic device, including a processor and the non-transitory computer-readable storage medium, wherein the storage medium may be provided in the electronic device to store at least one readable instruction or at least one program for implementing a method in the method embodiment, wherein the at least one readable instruction or the at least one program is loaded and executed by the processor to implement:

[0095] S100, receiving a target access request corresponding to a target login account, wherein the target login account is an account that requests to log in to a target database and establish a connection access with the target database.

[0096] S200, when the target login account is an abnormal account, reject the target access request to deny the user who controls the target login account from accessing the target database.

[0097] S300, when the target login account is a normal account, obtaining a target priority corresponding to the target database, wherein the target priority is a security level of the target database obtained based on the importance of the target database.

[0098] S400, when the target priority is the first target level, setting first verification information for the target login account.

[0099] S500, when the target priority is a second target level, setting second verification information for the target login account.

[0100] S600, when the target priority is the third target level, setting third verification information for the target login account.

[0101] S700, obtaining a target accuracy rate corresponding to a target login account, wherein the target accuracy rate is an accuracy rate of a user controlling the target login account to answer target verification information, and the target verification information is the first verification information, the second verification information, or the third verification information.

[0102] S800, when the target accuracy is 1, a target access request is used to control the user of the target login account to access the target database.

[0103] Although some specific embodiments of the present invention have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. An access control method, characterized in that: The method comprises the following steps: S100, receiving a target access request corresponding to a target login account, wherein the target login account is an account that requests to log in to a target database and establish a connection access with the target database; S200, when the target login account is an abnormal account, rejecting the target access request to deny the user who controls the target login account from accessing the target database; S300, when the target login account is a normal account, obtaining a target priority corresponding to the target database, wherein the target priority is a security level of the target database obtained based on the importance of the target database; S400, when the target priority is the first target level, setting first verification information for the target login account; S500, when the target priority is the second target level, setting second verification information for the target login account, wherein the second verification information is obtained in S500 through the following steps: S501, obtaining a set of verification problems to be selected, wherein the set of verification problems to be selected includes a plurality of verification problems to be selected, wherein S501 also includes the following steps: S5011, obtaining a first sample verification question set, wherein the first sample verification question set includes a plurality of first sample verification questions, the first sample verification questions are verification questions obtained from a specified database, and the verification questions are questions used to verify login authority of a login account; S5012, obtaining a second sample verification problem set according to the first sample verification problem set, wherein the second sample verification problem set includes a plurality of second sample verification problems, and the second sample verification problems are verification problems obtained by expanding the first preset LLM model based on the first sample verification problem set; S5013, determining a first candidate verification problem set according to the second sample verification problem set, wherein the first candidate verification problem set includes a plurality of first candidate verification problems, and the first candidate verification problems are second sample verification problems obtained by screening the second sample verification problems in the second sample verification problem set; S5014, obtaining a second candidate verification problem set according to the first candidate verification problem set, wherein the second candidate verification problem set includes Q second candidate verification problems, and the second candidate verification problems are first candidate verification problems randomly obtained from the first candidate verification problem set, wherein Q meets the following conditions: , P is the number of times the target database is accessed within a preset time period, K is the number of second candidate verification problems randomly selected from the second candidate verification problem set, and Q is the number of second candidate verification problems in the second candidate verification problem set; S5015, forming a to-be-selected verification problem set with K second candidate verification problems randomly selected from the second candidate verification problem set; S502, obtaining first verification information, wherein the first verification information is a password corresponding to the target login account and a verification code of a device corresponding to the target login account; S503, acquiring second verification information according to the first verification information and the set of verification questions to be selected, wherein the second verification information includes the first verification information and the set of verification questions to be selected; S600, when the target priority is a third target level, setting third verification information for the target login account; S700, obtaining a target accuracy rate corresponding to a target login account, wherein the target accuracy rate is an accuracy rate of a user controlling the target login account to answer target verification information, and the target verification information is the first verification information, the second verification information, or the third verification information; S800, when the target accuracy is 1, a target access request is used to control the user of the target login account to access the target database.

2. The access control method according to claim 1, characterized in that: The first verification information is the password corresponding to the target login account and the verification code of the device corresponding to the target login account.

3. The access control method according to claim 1, characterized in that: The value of K is 2 or 3.

4. The access control method according to claim 1, characterized in that: In S600, the third verification information is obtained through the following steps: S601, obtaining first verification information, wherein the first verification information is a password corresponding to a target login account and a verification code of a device corresponding to the target login account; S602, obtaining a set of verification problems to be selected, wherein the set of verification problems to be selected includes K verification problems to be selected; S603, obtaining a target feature information set, wherein the target feature information set includes a plurality of target feature information, and the target feature information is feature information corresponding to the target data; S604, inputting the target feature information set into the second preset LLM model to obtain a key verification problem set, wherein the key verification problem set includes a plurality of key verification problems, and the key verification problems are verification problems generated by the second preset LLM model based on the target feature information set; S605, obtaining a specified verification problem set according to the key verification problem set, wherein the specified verification problem set includes N specified verification problems, the specified verification problems are key verification problems randomly obtained from the key verification problem set, and N is the number of specified verification problems in the specified verification problem set; S606, obtaining third verification information, wherein the third verification information includes the first verification information, a set of to-be-selected verification questions, and a set of specified verification questions.

5. The access control method according to claim 4, characterized in that: N meets the following conditions: N=ZK, Z is a preset constant.

6. A non-transitory computer-readable storage medium, characterized in that: The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the access control method as described in any one of claims 1-5.

7. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 6.

Images