A method for managing read and write permissions of replica data sets

Abstract

The present invention discloses a method for managing read and write permissions of a replica data set. The present invention relates to the technical field of permission management and solves the technical problem that the permission usage of personnel with different permissions cannot be identified and the risk warning analysis of permissions cannot be performed, which affects data security. The present invention accurately classifies the permission personnel according to the read and write permissions of the assigned personnel, generates comprehensive and accurate permission personnel classification information, identifies the permission usage of personnel with different permissions, analyzes the historical operations of the permission personnel, calculates the permission risk value of the permission personnel and generates permission risk value information, identifies the permission risk level corresponding to the permission personnel according to the generated permission risk information, and manages and generates management information based on the change of the permission risk value within a time period, including how to set the evaluation interval, match the risk level and take different management measures according to the risk level.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a method for managing read and write authority of a replica data set. Background Art

[0002] In today's digital age, enterprises and organizations have increasingly higher requirements for data and system security. Permission management has become a key link in ensuring data security and stable system operation. By reasonably allocating and managing personnel's read and write permissions, data access and operations can be effectively controlled to prevent unauthorized access and data leakage.

[0003] According to the publication number CN115510471A, a permission management method, a computer-readable storage medium, a system and a device are disclosed, which relate to the field of management. When receiving a safe mode start instruction, it is determined whether the safe mode start instruction has the safe mode start permission; if so, the identification information and read-write permission of the file that needs to set the safe mode are obtained according to the safe mode start instruction; according to the read-write permission of the file, the read-write state of the file corresponding to the identification information is set to enable the file to enter the safe mode.

[0004] However, in some existing technologies, when managing read and write permissions, the permission usage of personnel with different permissions cannot be identified, which further leads to the inability to perform reasonable risk warning management based on the historical records of authorized personnel, so that authorized personnel may affect data security during subsequent use. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a method for managing read and write permissions for a replica data set, which solves the problem of not being able to identify the usage of permissions by personnel with different permissions and not being able to conduct risk warning analysis on permissions, thus affecting data security.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for managing read and write permissions of a replica data set, the method specifically comprising the following steps:

[0007] S101, classifying authorized personnel according to the read and write permissions of the assigned personnel to generate authorized personnel classification information;

[0008] S102, identifying the permission usage of different permission personnel according to the permission personnel classification information, and generating permission identification results, wherein the permission identification results include normal usage results and abnormal usage results;

[0009] S103, analyzing the abnormal usage results obtained, obtaining and analyzing the historical operations of the authorized personnel, calculating the authority risk value of the authorized personnel, and generating authority risk value information;

[0010] S104, identifying the authority risk information corresponding to the authority personnel according to the generated authority risk information, and managing and generating management information based on the change of the authority risk value within a time period.

[0011] As a further solution of the present invention: the specific method of generating the classification information of authorized personnel in S101 is:

[0012] Obtain the read and write permissions of all assigned personnel, as well as the permission levels of the read and write permissions, and classify the authorized personnel according to the permission levels to obtain the classification information of the authorized personnel.

[0013] As a further solution of the present invention: the specific method of generating the permission identification result in S102 is:

[0014] Obtain any authorized person in the authorized person classification information as the analysis object, and label the analysis object as i, where i=1, 2, ..., j, where j represents the number of authorized persons in the sharing object, and at the same time obtain the real-time IP corresponding to the authorized person i, and match the real-time IP with the fixed IP;

[0015] If the real-time IP used is the same as the fixed IP, it means that the usage of the current authorized person i is normal, and a normal usage result is generated. If the real-time IP used is different from the fixed IP, it means that the usage of the current authorized person i is abnormal, and a secondary verification signal is generated and analyzed.

[0016] As a further solution of the present invention: the specific method of analyzing the secondary verification signal in S102 is:

[0017] Obtain the historical records corresponding to the authorized person i, and classify the historical IP used by the authorized person i according to the historical records. At the same time, obtain the usage times of the classified historical IPs, and calculate the usage percentages of the historical IPs of different classifications. At the same time, record the historical IPs corresponding to the usage percentage values ​​exceeding the preset value Y1 as normal IPs, and record the historical IPs corresponding to the usage percentage values ​​less than the preset value Y2 as abnormal IPs, and generate IP classification information;

[0018] The real-time IP usage of authorized person i is matched with the IP classification information. If the real-time IP usage does not match the normal IP usage in the IP classification information, it means that the usage record of the current authorized person i is abnormal, and an abnormal usage result is generated.

[0019] As a further solution of the present invention: the specific method of generating the authority risk value information in S103 is:

[0020] Get the authorized personnel corresponding to the abnormal usage results, and at the same time get any of the authorized personnel as the target object, and get the historical operations of the target object, and at the same time get the number of abnormal operations in the historical operations of the target object, and label the number of abnormal times as a, and a=1, 2, ..., b, where b represents the number of abnormal times, and then analyze the abnormal number a separately.

[0021] As a further solution of the present invention: the specific method of separately analyzing the abnormal parameters in S103 is:

[0022] Take any one of the abnormal times as the analysis target, obtain the operation duration in the analysis target and record it as T, and obtain the operation change corresponding to the analysis target and record it as D, and substitute the obtained parameters into the formula The change value S of the analysis target is calculated, where is the preset proportional coefficient, and the change value S of all abnormal times a is calculated and recorded as Sa in this way;

[0023] Then, the abnormal operation time interval corresponding to the abnormal number a is obtained and recorded as To, where o=1, 2, ..., p. At the same time, the mean of all abnormal operation time intervals is calculated and recorded as Tp. The calculated parameters are substituted into the formula Calculate the permission risk value Qi corresponding to the target object, where Sp is the mean change value of the target object. is the preset scale factor.

[0024] As a further solution of the present invention: the specific method of generating the permission risk information in S104 is:

[0025] The authority risk values ​​of personnel with different authorities are obtained, and the corresponding evaluation intervals are obtained at the same time. Then, the authority risk values ​​of personnel with different authorities are matched with the evaluation intervals. At the same time, the corresponding authority risk information is generated according to the matching results, and the authority risk information is periodically monitored.

[0026] As a further solution of the present invention: the specific method of periodically monitoring the authority risk information in S104 is:

[0027] Obtain the authority risk value corresponding to the authorized personnel within the time period t, and determine the change of the authority risk value. If the authority risk value increases, determine the risk level based on the real-time authority risk value, and generate corresponding management information based on the risk level. If the authority risk value decreases, determine the risk level based on the increase, and generate corresponding management information based on the risk level. Beneficial Effects

[0028] The present invention provides a method for managing read and write permissions of a replica data set. Compared with the prior art, it has the following beneficial effects:

[0029] The present invention generates comprehensive and accurate classification information of authorized personnel by accurately classifying authorized personnel according to the read and write permissions of assigned personnel, and effectively identifies the usage of permissions of different authorized personnel on the basis of the classification of authorized personnel, calculates the permission risk value of the authorized personnel and generates permission risk value information by analyzing the historical operations of the authorized personnel, identifies the permission risk level corresponding to the authorized personnel according to the generated permission risk information, and manages and generates management information based on the changes in the permission risk value within a time period, including how to set the evaluation interval, match the risk level, and take different management measures according to the risk level, so as to improve the security of permission management and ensure the security of subsequent data use. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] See also Figure 1 The present application provides a method for managing read and write permissions of a replica data set, which specifically includes the following steps:

[0033] In step S101, authorized personnel are classified according to the read and write permissions of the assigned personnel to generate authorized personnel classification information.

[0034] Get the read and write permissions of all assigned personnel, and get the permission level of the read and write permissions. The specific permission level is the standard for dividing the scope and degree of user permissions, which is usually used to determine the type and degree of operations that users can perform in the system, software or specific environment, and classify the authorized personnel according to the permission level to obtain the classification information of the authorized personnel. For example, the classified personnel include super administrators, administrators, editors and viewers.

[0035] In a specific example, assume that there are personnel A, B, C, D, and E. Personnel A is assigned advanced read and write permissions, and the permission level is advanced. This means that personnel A can perform comprehensive modification, deletion, and addition operations on the company's core database, and can access key data in the company's core business management system. Personnel B and personnel C are assigned intermediate read and write permissions, and the permission level is intermediate. They can read most of the data and modify some non-critical data, but cannot delete important data or access core confidential systems. Personnel D and personnel E are assigned low-level read and write permissions, and the permission level is low. They can only read data and cannot perform any modification or deletion operations. By classifying the permission levels of these personnel, we obtain the classification information of authorized personnel, that is, the high-level permission personnel are A, the intermediate permission personnel are B and C, and the low-level permission personnel are D and E.

[0036] Next, in step S102, the permission usage of different permission persons is identified according to the permission person classification information, and a permission identification result is generated, wherein the permission identification result includes a normal usage result and an abnormal usage result.

[0037] Any person of the authorized type in the authorized person classification information is obtained as the analysis object, and the analysis object is labeled as i, and i=1, 2, ..., j, where j represents the number of authorized persons in the sharing object. At the same time, the real-time IP used by the authorized person i is obtained, and the real-time IP used is matched with the fixed IP; and the fixed IP here represents the system's default IP address, which is set at the beginning.

[0038] If the real-time IP is the same as the fixed IP, it means that the usage of the current authorized person i is normal, and a normal usage result is generated. If the real-time IP is different from the fixed IP, it means that the usage of the current authorized person i is abnormal, and a secondary verification signal is generated;

[0039] Then, the generated secondary verification signal is analyzed to obtain the historical records corresponding to the authorized person i, and the historical IP used by the authorized person i is classified according to the historical records. At the same time, the number of times the classified historical IP is used is obtained, and the usage ratio values ​​of the historical IP used by different categories are calculated. Then, the usage ratio values ​​are plotted in the form of a pie chart, and the historical IP used with a usage ratio value exceeding the preset value Y1 is recorded as a normal IP used, and the historical IP used with a usage ratio value less than the preset value Y2 is recorded as an abnormal IP used, and IP classification information is generated, and the preset values ​​Y1 and Y2 here are expressed as different ratio values, and the specific values ​​are set by the operator;

[0040] In a specific example, suppose that there are 100 login records in the history of authorized personnel i, of which 30 are from IP address A, 40 are from IP address B, 20 are from IP address C, and 10 are from other IP addresses. Then, the usage ratio of IP addresses in different categories is calculated. The usage ratio of IP address A is 30%, the usage ratio of IP address B is 40%, the usage ratio of IP address C is 20%, and the usage ratio of other IP addresses is 10%.

[0041] Then, the usage percentage is plotted in the form of an intuitive pie chart to more clearly show the usage percentage of different IP addresses. At the same time, the preset value Y1 is set to 35%, the preset value Y2 is set to 15%, and the historical IP usage corresponding to the usage percentage exceeding the preset value Y1 (in this case, IP address B) is recorded as the normal IP usage, and the historical IP usage corresponding to the usage percentage less than the preset value Y2 (in this case, other IP addresses) is recorded as the abnormal IP usage.

[0042] The real-time IP usage of authorized personnel i is matched with the IP classification information. If the real-time IP usage does not match the normal IP usage in the IP classification information, it means that the usage record of the current authorized personnel i is abnormal, and an abnormal usage result is generated; and here it is indicated that as long as the current real-time IP usage does not match the normal IP usage, it is always indicated as abnormal.

[0043] Next, in step S103, the abnormal usage result is analyzed, and the authority risk value of the authority personnel is calculated by acquiring and analyzing the historical operations of the authority personnel, and authority risk value information is generated.

[0044] Obtain the authorized personnel corresponding to the abnormal usage result, and at the same time obtain any of the authorized personnel as the target object, and obtain the historical operations of the target object, and at the same time obtain the number of abnormal operations in the historical operations of the target object. The identification method of the abnormal operation here is to analyze the system resource usage through the analysis of the authorized personnel's use of system resources, such as CPU occupancy, memory usage, network traffic, etc. For example, when a normal data analyst runs a specific data analysis software, the CPU occupancy is usually between 30% and 50%, and the network traffic will also fluctuate within a certain range. The number of abnormal times is marked as a, and a=1, 2, ..., b, where b represents the number of abnormal times, and then the abnormal number a is analyzed separately;

[0045] Take any one of the abnormal times as the analysis target, obtain the operation duration in the analysis target and record it as T, and obtain the operation change corresponding to the analysis target and record it as D. The operation change here represents the amount of abnormal data generated by the abnormal operation within the operation duration T, and substitute the obtained parameters into the formula The change value S of the analysis target is calculated, where is the preset proportional coefficient, and the change value S of all abnormal times a is calculated and recorded as Sa in this way;

[0046] Then, the abnormal operation time interval corresponding to the abnormal number a is obtained and recorded as To, and o=1, 2, ..., p, and the label 1 here represents the time interval between the abnormal number label 2 and the abnormal number label 1, specifically p=b-1, and the mean of all abnormal operation time intervals is calculated and recorded as Tp, and the calculated parameters are substituted into the formula Calculate the permission risk value Qi corresponding to the target object, where Sp is the mean change value of the target object. is the preset proportional coefficient;

[0047] The same process is applied to all authorized personnel in this manner.

[0048] In step S104, the authority risk information corresponding to the authority personnel is identified according to the generated authority risk information, and management information is generated based on the change of the authority risk value within a time period.

[0049] The authority risk values ​​of personnel with different authority are obtained, and the corresponding evaluation intervals are obtained at the same time. The evaluation intervals here are set by the operator according to the actual data of all personnel with authority. The specific evaluation intervals are three risk levels, and each risk level corresponds to an authority risk value interval. The corresponding risks from level one to level three gradually increase. Then the authority risk values ​​of personnel with different authority are matched with the evaluation intervals, and the corresponding authority risk information is generated according to the matching results. For example, for the first risk level, the corresponding authority personnel need to be reminded, and for the second risk level, the corresponding authority personnel need to be reminded to verify the account and regularly modify the login information. For the third risk level, the corresponding authority personnel need to be restricted from operating, and the authority personnel need to be re-verified.

[0050] In a specific example, for example, the operator sets the following evaluation intervals based on past permission usage and possible risks: the permission risk value interval corresponding to the first-level risk level is 0-30, the permission risk value interval corresponding to the second-level risk level is 31-60, and the permission risk value interval corresponding to the third-level risk level is 61-100. For employee A who has ordinary file viewing permissions, the permission risk value calculated through a series of evaluation indicators is 25, so the permission risk information of employee A is judged to be the first-level risk level, indicating that the permission risk is relatively low. For employee B who has file editing and some important file access permissions, the calculated permission risk value is 75, so the permission risk information of employee B is the third-level risk level.

[0051] For the generated authority risk information, periodic monitoring is carried out to obtain the authority risk value corresponding to the authorized personnel within the time period t, and the change of the authority risk value is judged. If the authority risk value increases, the risk level is determined based on the real-time authority risk value, and the corresponding management information is generated according to the risk level. If the authority risk value decreases, the risk level is determined in the same way as if it increases, and the corresponding management information is generated based on the risk level.

[0052] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0053] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for managing read and write permissions of a replica data set, characterized in that: The method specifically comprises the following steps: S101, classifying authorized personnel according to the read and write permissions of the assigned personnel to generate authorized personnel classification information; S102, identifying the permission usage of different permission personnel according to the permission personnel classification information, and generating permission identification results, wherein the permission identification results include normal usage results and abnormal usage results; S103, analyzing the abnormal usage results obtained, obtaining and analyzing the historical operations of the authorized personnel, calculating the authority risk value of the authorized personnel, and generating authority risk value information, and the specific method of separately analyzing the abnormal parameters is: Take any one of the abnormal times as the analysis target, obtain the operation duration in the analysis target and record it as T, and obtain the operation change corresponding to the analysis target and record it as D, and substitute the obtained parameters into the formula The change value S of the analysis target is calculated, where is the preset proportional coefficient; Then, the abnormal operation time interval corresponding to the abnormal number a is obtained and recorded as To, where o=1, 2, ..., p. At the same time, the mean of all abnormal operation time intervals is calculated and recorded as Tp. The calculated parameters are substituted into the formula Calculate the permission risk value Qi corresponding to the target object, where Sp is the mean change value of the target object. is the preset proportional coefficient, b is the number of abnormal times, and Sa is the change value of the abnormal number a; S104, identifying the authority risk information corresponding to the authority personnel according to the generated authority risk information, and managing and generating management information based on the change of the authority risk value within a time period.

2. A method for managing read and write permissions of a replica data set according to claim 1, characterized in that: The specific method of generating the classification information of authorized personnel in S101 is: Obtain the read and write permissions of all assigned personnel, as well as the permission levels of the read and write permissions, and classify the authorized personnel according to the permission level to obtain the classification information of the authorized personnel.

3. A method for managing read and write permissions of a replica data set according to claim 1, characterized in that: The specific method of generating the permission identification result in S102 is: Obtain any authorized person in the authorized person classification information as the analysis object, and label the analysis object as i, where i=1, 2, ..., j, where j represents the number of authorized persons in the sharing object, and at the same time obtain the real-time IP corresponding to the authorized person i, and match the real-time IP with the fixed IP; If the real-time IP used is the same as the fixed IP, it means that the usage of the current authorized person i is normal, and a normal usage result is generated. If the real-time IP used is different from the fixed IP, it means that the usage of the current authorized person i is abnormal, and a secondary verification signal is generated and analyzed.

4. A method for managing read and write permissions of a replica data set according to claim 3, characterized in that: The specific method of analyzing the secondary verification signal in S102 is: Obtain the historical records corresponding to the authorized person i, and classify the historical IP used by the authorized person i according to the historical records. At the same time, obtain the usage times of the classified historical IPs, and calculate the usage percentages of the historical IPs of different classifications. At the same time, record the historical IPs corresponding to the usage percentage values ​​exceeding the preset value Y1 as normal IPs, and record the historical IPs corresponding to the usage percentage values ​​less than the preset value Y2 as abnormal IPs, and generate IP classification information; The real-time IP usage of authorized person i is matched with the IP classification information. If the real-time IP usage does not match the normal IP usage in the IP classification information, it means that the usage record of the current authorized person i is abnormal, and an abnormal usage result is generated.

5. A method for managing read and write permissions of a replica data set according to claim 1, characterized in that: The specific method of generating the authority risk value information in S103 is: Get the authorized personnel corresponding to the abnormal usage results, and at the same time get any of the authorized personnel as the target object, and get the historical operations of the target object, and at the same time get the number of abnormal operations in the historical operations of the target object, and label the number of abnormal times as a, and a=1, 2, ..., b, where b represents the number of abnormal times, and then analyze the abnormal number a separately.

6. A method for managing read and write permissions of a replica data set according to claim 1, characterized in that: The specific method of generating the permission risk information in S104 is: The authority risk values ​​of personnel with different authorities are obtained, and the corresponding evaluation intervals are obtained at the same time. Then, the authority risk values ​​of personnel with different authorities are matched with the evaluation intervals. At the same time, the corresponding authority risk information is generated according to the matching results, and the authority risk information is periodically monitored.

7. A method for managing read and write permissions of a replica data set according to claim 6, characterized in that: The specific method of periodically monitoring the authority risk information in S104 is: Obtain the authority risk value corresponding to the authorized personnel within the time period t, and determine the change of the authority risk value. If the authority risk value increases, determine the risk level based on the real-time authority risk value, and generate corresponding management information based on the risk level. If the authority risk value decreases, determine the risk level based on the increase, and generate corresponding management information based on the risk level.

Images