A multi-dimensional factor security management system for government documents

Abstract

The present invention discloses a multi-dimensional factor security management system for government documents, which belongs to the field of document security management and aims to solve the problems of user identity authentication, authority control, data protection and abnormal behavior monitoring in document security management. It includes: an identity authentication module, an access control module, an access encryption module and an audit monitoring module; the identity authentication module is used to confirm the user identity through multi-level authentication when receiving a user's login request; the access control module is used to allocate user access channels according to the risk level during user login authentication; the access encryption module is used to dynamically encrypt the access channel of the user access operation, and the dynamic encryption dynamically adjusts the encryption parameters based on the user access channel and the user risk level on the basis of basic security encryption; the audit monitoring module is used to record the user's access and operation behavior to government documents in real time, and perform abnormal risk assessment on government documents according to the log records.

Description

Technical Field

[0001] The present invention relates to the field of document security management, and more specifically to a multi-dimensional factor security management system for government documents. Background Art

[0002] With the rapid development of science and technology, the information age has arrived. In this era, e-government, as an important part of government work, is playing an increasingly important role. E-government not only improves the work efficiency of the government, but also provides more convenient services for the public. However, with the popularization of e-government, the security management issues of government documents have gradually become prominent. In e-government, the security issues of government documents mainly include data leakage, illegal access, tampering, etc. At present, the existing government document management systems often rely on a single security mechanism, such as password protection or access control. However, these security mechanisms often seem powerless in the face of increasingly complex security threats. Password protection may be cracked and access control may be bypassed, resulting in threats to the security of government documents. Therefore, in order to improve the security of government documents, we need a more comprehensive and multi-dimensional security management system.

[0003] The invention patent with announcement number CN102043924B discloses a file management system and method. The file management system includes: a storage unit, a parsing unit, a management unit, and a browsing terminal, wherein the storage unit stores files, and the files can only be read by the management unit; the parsing unit parses the user's application for accessing the file and obtains the application information; the management unit reads the file matching the application information from the storage unit, sends the file to the browsing terminal with a system matching the application information, and sends the identity mark corresponding to the application information to the browsing terminal; the browsing terminal creates a copy of the file sent by the management unit, and provides a read-only operation of the file copy corresponding to the identity mark when the identity mark of the request for accessing the copy matches the identity mark provided by the management unit.

[0004] Although the existing technology can reduce the risk of key information loss, it still fails to solve the problems of user identity authentication, authority control, data protection and abnormal behavior monitoring in file security management. Therefore, in order to overcome these limitations, the present invention proposes a multi-dimensional factor security management system for government documents. Summary of the invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a multi-dimensional factor security management system for government documents, which solves the problems of user identity authentication, authority control, data protection and abnormal behavior monitoring in document security management. Multi-level authentication and risk assessment strategies are used to confirm user identities, and corresponding data access rights are allocated according to the user's risk level. At the same time, the user's data access operations are dynamically encrypted, and encryption parameters are adjusted according to user behavior and risk level to provide additional protection. In addition, through real-time monitoring and pattern recognition technology, abnormal risks are evaluated and early warnings are issued in a timely manner to prevent unauthorized access and data leakage.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A multi-dimensional factor security management system for government documents, comprising an identity authentication module, an access control module, an access encryption module and an audit monitoring module;

[0008] The identity authentication module is used to confirm the user's identity through multi-level authentication when receiving a user's login request;

[0009] The access control module is used to allocate user access channels according to the risk level of the user during login authentication, and the access channels are used to distinguish the security level and authority level of the data access path;

[0010] The access encryption module is used to dynamically encrypt the access channel of the user access operation, and the dynamic encryption dynamically adjusts the encryption parameters based on the user access channel and the user risk level on the basis of the basic security encryption;

[0011] The audit monitoring module is used to record users' access and operation behaviors to government documents in real time, and to conduct abnormal risk assessment on government documents based on log records.

[0012] Specifically, the multi-level authentication is provided with a risk assessment strategy, which is used to assess the authentication risk level when a user logs in for authentication through identity authentication technology. The authentication risk level is obtained by a comprehensive score of multi-dimensional factor scores, and the multi-dimensional factor scores are obtained by the user login behavior score and the user login identification score.

[0013] Specifically, the steps of obtaining the user login behavior score include:

[0014] Calculate the time deviation between the user's current login time and the most frequent login time period, then divide this deviation by the standard deviation threshold, take the square of the deviation and subtract it from the full score to obtain the login time score. The calculation formula is as follows: ,in, is the login time score, is the time deviation, is the standard deviation threshold, is the full score;

[0015] Configure the time threshold T1, calculate the number of logins within the time period from login time T1, and compare it with the upper limit of normal login frequency. Reduce the score according to the excess ratio to obtain the login frequency score. The calculation formula is as follows: ,in, is the login frequency score, is the number of logins within the time period from login time T1, is the upper limit of normal login frequency, is the full score;

[0016] Determine the geographical distance between the user's current login location and the frequently used login location, configure the distance threshold T2, and reduce the score every T2 according to the geographical distance between the current login location and the frequently used login location to obtain the login location score. The calculation formula is as follows: ,in, is the login location score, is the geographical distance between the current login location and the usual login location, is the rounding function, is the score reduction ratio, It is a full score.

[0017] Specifically, the user login behavior score, the step of obtaining further comprises:

[0018] The user behavior score is the reciprocal of the average of the reciprocals of the login time score, login frequency score, and login location score. The calculation formula is as follows: ,in, is the user behavior score, is the login time score, is the login frequency score, It is the login location score.

[0019] Specifically, the user login identification score, the steps of obtaining include:

[0020] Record the number of login attempts A used by the user to successfully log in, and reduce the login score according to the login attempts, and configure the login score reduction ratio , to obtain the final login score, namely: ,in, is the login score, It is a full score, and failed login attempts will significantly affect the score, thus helping to identify potential brute force attacks;

[0021] According to the reason for the login failure, the initial score is set, and it is stipulated that when the error occurs repeatedly, the score will be reduced by a certain percentage. The calculation formula is as follows: ,in, The jth login error reason occurs Login error score for each time, is the login error score, is the initial score of the jth login error reason, is the decreasing percentage of the jth login error reason, is the number of times the jth login error reason occurs, is the number of error causes, It is a full score.

[0022] Specifically, the user login identification score obtaining step further includes:

[0023] The user login identification score is calculated based on the login count score and the login error score through the weighted arithmetic average. The calculation formula is as follows: ,in, is the user login identification score, is the login score, is the login error score, and are the weights of the login count score and login error score respectively.

[0024] Specifically, the step of confirming the user identity includes:

[0025] A first identity authentication technology is selected through a multi-factor authentication mechanism, and the user identity is authenticated according to the first identity authentication technology; if the user is successfully authenticated through the first identity authentication technology, the authentication risk level of the user during authentication is obtained through a risk assessment strategy, and if the risk level is a low risk level, the authentication is successful;

[0026] If the risk level is medium risk level, the second identity authentication technology is selected through the multi-factor authentication mechanism. If the user's second identity authentication technology is successfully authenticated, the authentication is successful, otherwise the authentication fails;

[0027] If the risk level is high, the second identity authentication technology and the third identity authentication technology are selected through the multi-factor authentication mechanism. If the user's second identity authentication technology and the third identity authentication technology are both successfully authenticated, the authentication is successful, otherwise the authentication fails;

[0028] The multi-factor authentication mechanism selects an identity authentication technology in the authentication library by a random selection method. The random selection method means that when a user initiates a login request, the identity authentication module selects an identity authentication technology in the authentication library based on a random principle.

[0029] Specifically, the basic security encryption includes: in the initialization phase, a master key is generated by a random number generator , ,in, The seed used to represent random numbers, Indicates the number of bits of the master key, which is stored in the hardware module;

[0030] When a user requests access, a session key is derived from the master key The life cycle of the session key is limited to the current session. The session key and encryption parameters are sent to the client and server. The calculation formula is as follows: ,in, is the key derivation function, is the session ID, is the session timestamp;

[0031] During data transmission, the session key is used to perform multi-layer encryption on the data. For the multi-layer encryption, a multi-layer encryption base L is established, and the number of encryption layers is dynamically selected according to the risk level of the user when logging in;

[0032] Use the session key to decrypt the data layer by layer and verify the integrity of the data. If the verification passes, use the session key to restore the original data. After the session ends, destroy the session key, clear the encrypted data in the memory, and update the master key regularly.

[0033] Specifically, the key derivation function is constructed based on the output feedback mode of the AES encryption algorithm, using the result of the concatenation of the session ID and the timestamp as the initialization vector, and inputting it and the master key into the AES-OFB mode. The calculation formula is as follows: ,in, Indicates that the session ID and timestamp Connect them in series and use them as input to the AES algorithm.

[0034] Specifically, the dynamically adjusting encryption parameters based on the user access channel and the user risk level includes:

[0035] Identify the user access channel, and if the user access channel is the first channel, use basic security encryption;

[0036] If the user is the second channel, the number of bits of the master key is increased on the basis of basic security encryption, that is, ,in is a positive constant, used to represent the multiple of the number of bits of the second channel master key increased on the basis of the basic encryption. is the number of bits of the second channel master key;

[0037] The number of encryption layers is dynamically selected based on the risk level of the user when logging in. Based on the multi-layer encryption base L, the number of encryption layers is dynamically selected, including L layers of encryption for low risk levels and L layers of encryption for medium risk levels. L-layer encryption, high risk level L-layer encryption, where It is a positive constant used to represent the difference in the number of encryption layers for different risk levels.

[0038] Specifically, the abnormal risk assessment rates the log records of government documents through pattern recognition, issues abnormal risk warnings based on the abnormal risk levels, and performs event tracing for government documents with abnormal risks. The pattern recognition establishes a behavioral pattern baseline for normal access through historical log records, and uses machine learning algorithms to identify log records that deviate from the behavioral pattern baseline.

[0039] Beneficial effects of the present invention:

[0040] 1. Through multi-level authentication and risk assessment strategies, the user's identity can be confirmed and its risk level can be assessed more accurately. This includes a comprehensive score of the user's login behavior score and the user's login identification score, as well as the application of multi-factor authentication mechanisms, such as biometric recognition and password authentication. This greatly improves the defense capabilities against malicious users and automated attacks. The access control module allocates access channels according to the user's risk level to achieve differentiated protection of sensitive information and key resources. Low-risk users are granted a wider range of operating permissions, while the permissions of medium- and high-risk users are restricted, especially for operations on confidential and secret files, thereby effectively preventing data leakage and unauthorized access.

[0041] 2. The access encryption module dynamically adjusts encryption parameters, including the number of master key bits and the number of encryption layers, based on the user's access channel and risk level. This dynamic adjustment ensures that data transmission and storage are properly protected under different security requirements and operating environments. For example, for high-risk users, the number of master key bits and the number of encryption layers will be increased to provide stronger security. The master key generated during the initialization phase is stored in the hardware module to ensure the secure isolation of the key. The generation and destruction mechanism of the session key, as well as the strategy of regularly updating the master key, further ensure the freshness of the key and the security of the system.

[0042] 3. The audit monitoring module records the user's access and operation behavior on government documents in real time, and conducts abnormal risk assessment through pattern recognition technology. Using machine learning algorithms, it can identify log records that deviate from the baseline of normal behavior patterns, and conduct risk rating and early warning based on the deviations. When abnormal behavior is detected, not only will an early warning be issued, but the event will also be traced, the relevant user accounts and government documents will be locked, and the early warning information will be sent to the responsible department. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a structural diagram of a multi-dimensional factor security management system for government documents;

[0044] Figure 2 Flowchart for the calculation of multidimensional factor scores;

[0045] Figure 3 A flowchart of the steps for confirming the user's identity;

[0046] Figure 4 A flowchart of the basic security encryption steps;

[0047] Figure 5 Flow chart of risk rating warning. DETAILED DESCRIPTION

[0048] See also Figure 1 ,This embodiment introduces a multi-dimensional factor security management system for government documents, including an identity authentication module, an access control module, an access encryption module and an audit monitoring module;

[0049] The identity authentication module is used to confirm the user's identity through multi-level authentication when receiving a user's login request; the multi-level authentication is provided with a risk assessment strategy, and the risk assessment strategy is used to assess the authentication risk level of the user when logging in through the identity authentication technology, and the authentication risk level is obtained by a comprehensive score of multi-dimensional factor scores;

[0050] See also Figure 2 , the multi-dimensional factor score includes: a user login behavior score and a user login identification score;

[0051] The user login behavior score is used to identify risky behaviors based on user login habits, and the user login behavior score is obtained by analyzing login time, login frequency, and login location;

[0052] The user login identification score is used to identify risky behaviors based on user login attempts, and the user login identification score is obtained by analyzing the number of login attempts and the reasons for login errors;

[0053] The obtaining of the user login behavior score includes:

[0054] Perform login time analysis, calculate the time deviation between the user's current login time and the most frequent login time period, then divide this deviation by the standard deviation threshold, take the square of it and subtract it from the full score to obtain the login time score. The calculation formula is as follows: ,in, is the login time score, is the time deviation, is the standard deviation threshold, It is a full score to ensure that if the user logs in during the regular login time, the deduction is small; if the login time deviates greatly from the normal range, the deduction is large, so as to effectively distinguish between normal and abnormal login times;

[0055] Perform login frequency analysis, configure the time threshold T1, calculate the number of logins within the time period from login time T1, and compare it with the upper limit of normal login frequency. Reduce the score according to the excess ratio to obtain the login frequency score. The calculation formula is as follows: ,in, is the login frequency score, is the number of logins within the time period from login time T1, is the upper limit of normal login frequency, It is a full score. In this way, frequent login attempts will cause the score to drop, which helps to identify possible malicious login attempts or machine attacks;

[0056] Perform login location analysis, measure the geographical distance between the user's current login location and the frequently used login locations, configure the distance threshold T2, and reduce the score every T2 according to the geographical distance between the current login location and the frequently used login locations to obtain the login location score. The calculation formula is as follows:

[0057] ,in, is the login location score, is the geographical distance between the current login location and the usual login location, is the rounding function, is the score reduction ratio, The score is full. Any abnormal change in geographic location will cause the score to drop, which helps the system determine possible unauthorized geographic location logins.

[0058] The user behavior score is obtained based on the login time score, login frequency score, and login location score. The scores are equally important. The user behavior score is the reciprocal of the average of the reciprocals of the login time score, login frequency score, and login location score to better reflect the balance between the scores. In particular, when some scores are low, a more conservative estimate will be given. The calculation formula is as follows: ,in, is the user behavior score.

[0059] The obtaining of the user login identification score comprises:

[0060] Perform login count analysis, record the number of login attempts A required for a user to successfully log in, and reduce the login count score based on the login attempts, and configure the login count reduction score ratio , to obtain the final login score, namely: ,in, is the login score, It is a full score, and failed login attempts will significantly affect the score, thus helping to identify potential brute force attacks;

[0061] Analyze the reasons for login errors, including incorrect passwords, non-existent accounts, locked accounts, and other reasons. Set an initial score based on the reasons for login failures, and stipulate that when errors occur repeatedly, the score will decrease by a certain percentage. The calculation formula is as follows:

[0062] ,in, The jth login error reason occurs Login error score for each time, is the login error score, is the initial score of the jth login error reason, is the decreasing percentage of the jth login error reason, is the number of times the jth login error reason occurs, is the full score to reflect that frequent errors indicate more serious security issues;

[0063] The user login identification score is calculated based on the login count score and the login error score through the weighted arithmetic average. The calculation formula is as follows: ,in, is the user login identification score, is the login score, is the login error score, and are the weights of the login count score and login error score respectively;

[0064] The multi-dimensional factor score takes the minimum value of the user behavior score and the user login identification score, that is, , configure the lower risk threshold T3 and the upper risk threshold T4, and the lower risk threshold T3 is less than the upper risk threshold T4. When the multi-dimensional factor score is less than the lower risk threshold T3, the risk level is high risk. When the multi-dimensional factor score is greater than the upper risk threshold T4, the risk level is low risk. The rest are medium risk levels, to ensure that the user's authentication risk level will be assessed as low risk only when both the user behavior score and the user login identification score perform well.

[0065] See also Figure 3 , the step of confirming the user identity includes:

[0066] A first identity authentication technology is selected through a multi-factor authentication mechanism, and the user identity is authenticated according to the first identity authentication technology; if the user is successfully authenticated through the first identity authentication technology, the authentication risk level of the user during authentication is obtained through a risk assessment strategy, and if the risk level is a low risk level, the authentication is successful;

[0067] If the risk level is medium risk level, the second identity authentication technology is selected through the multi-factor authentication mechanism. If the user's second identity authentication technology is successfully authenticated, the authentication is successful, otherwise the authentication fails;

[0068] If the risk level is high, the second identity authentication technology and the third identity authentication technology are selected through the multi-factor authentication mechanism. If the user's second identity authentication technology and the third identity authentication technology are both successfully authenticated, the authentication is successful, otherwise the authentication fails;

[0069] The multi-factor authentication mechanism selects an identity authentication technology from an authentication library by a random selection method. The identity authentication technologies in the authentication library include biometrics, password authentication, dynamic token authentication, and smart card authentication. The random selection method means that when a user initiates a login request, the identity authentication module selects an identity authentication technology from the authentication library based on a random principle.

[0070] The access control module is used to allocate user access channels according to the risk level of the user during login authentication. The access channel is used to distinguish the security level and authority level of the data access path. The access channel includes a first channel and a second channel to achieve differentiated protection of sensitive information and key resources, ensuring that only authorized users can access resources corresponding to their risk level.

[0071] The first channel is used for low-risk level user access operations, and opens all operation permissions of government documents within the user's authorization scope, and the operation permissions include read permission, write permission, modify permission, delete permission and download permission;

[0072] The second channel is used for access operations of medium-risk level users and high-risk level users. According to the type of government documents, the user's operation authority for government documents is reduced. The government document types include public-level documents, internal-level documents, confidential-level documents, and secret-level documents. The reduction of the user's operation authority for government documents includes disabling at least one of write authority, modify authority, delete authority, and download authority.

[0073] In this embodiment, through the implementation of the access control module, the risk assessment of users can be effectively carried out, and the corresponding access channels can be allocated accordingly. This differentiated protection strategy ensures that sensitive information and key resources are properly protected to prevent unauthorized access and data leakage. Specifically, users with low risk levels obtain access rights to the first channel and can fully operate government documents, thereby improving work efficiency; while users with medium and high risk levels are restricted to the second channel, and their operating rights to sensitive documents are strictly controlled to reduce potential security threats. For example, when a user tries to log in to the system, the access control module first authenticates the user and conducts a risk assessment. If the user passes multi-factor authentication and the historical behavior analysis shows a low risk trend, the user is identified as a low risk user. According to the user's risk level, the access control module assigns it to the first channel. The user can access and perform all operations on government documents within the scope of authorization, including reading, writing, modifying, deleting and downloading. For users with medium and high risk levels, the access control module assigns them to the second channel. Suppose a user needs to access a government document marked as confidential. Due to its high risk level, the system will restrict his operating permissions and may only allow read permissions, while disabling write, modify, delete and download permissions.

[0074] The access encryption module is used to dynamically encrypt the access channel of the user access operation. The dynamic encryption dynamically adjusts the encryption parameters based on the user access channel and the user risk level on the basis of the basic security encryption. The encryption parameters include the number of master key bits and the number of encryption layers; so as to achieve more accurate security protection, ensure that different user channels and users of different risk levels are given different security protection, and be able to flexibly adapt to different security needs, ensuring that data transmission and storage can be properly protected in various operating environments and risk conditions, thereby improving the overall information security level.

[0075] See also Figure 4 , the basic security encryption includes:

[0076] In the initialization phase, a master key is generated through a random number generator. , , where 1 is used to represent the seed of the random number, Indicates the number of bits of the master key, which is stored in the hardware module;

[0077] When a user requests access, a session key is derived from the master key The life cycle of the session key is limited to the current session. The session key and encryption parameters are sent to the client and server. The calculation formula is as follows: ,in, is the key derivation function, is the session ID, is the session timestamp;

[0078] During data transmission, the session key is used to perform multi-layer encryption on the data. For the multi-layer encryption, a multi-layer encryption base L is established, and the number of encryption layers is dynamically selected according to the risk level of the user when logging in;

[0079] Use the session key to decrypt the data layer by layer and verify the integrity of the data. If the verification is successful, use the session key to restore the original data. After the session ends, destroy the session key, clear the encrypted data in the memory, and update the master key regularly.

[0080] In this embodiment, a high-entropy random number is generated using a random number generation function in the initialization phase. The random number generation function includes a RANDBETWEEN function, a RAND function, and a random function. The number of bits for generating the master key is selected, for example, a 128-bit master key is selected. The generated random number has a high degree of unpredictability to ensure the security of the master key. The generated 128-bit master key is stored in a hardware security module to ensure the secure isolation and tamper-proofing of the key. The hardware security module provides physical and logical protection to prevent the key from being illegally accessed or stolen. Session key derivation, a session key is derived from the master key through a key derivation function. The session ID and the current timestamp are used as input parameters of the key derivation function to ensure that the key for each session is unique, thereby preventing replay attacks and prediction of the session key. The session key is only valid during the current session and is destroyed after the session ends. This limits the scope of use of the session key and reduces the risk of key leakage.

[0081] The number of encryption layers is dynamically selected based on the risk level of the user when logging in. For example, 1 layer of encryption is used for low risk level, 2 layers of encryption are used for medium risk level, and 3 layers of encryption are used for high risk level. This dynamic selection mechanism can adjust the encryption strength according to the actual security needs and improve the security of the system. Each layer of encryption can use different AES keys and algorithms. The combination of algorithms provides the security of multi-layer encryption. Even if one layer is cracked, the other layers can still protect the data security. Data is encrypted layer by layer, and each layer of encryption uses different keys and algorithms to ensure the security of multi-layer encryption. Multi-layer encryption increases the difficulty of data cracking and improves the security of data transmission.

[0082] After receiving the encrypted data, the same session key is used to decrypt the data layer by layer, and the original data is finally restored. If data tampering is found in any layer of decryption process, the session is terminated immediately and a security alarm is triggered. This prevents the infiltration of malicious data and data tampering. After the session ends, the session key is immediately destroyed and the encrypted data in the memory is cleared. This prevents the abuse of session keys and data leakage. The master key is updated regularly to keep the key fresh and the system secure. The update cycle can be monthly or quarterly. This prevents security risks caused by long-term use of keys.

[0083] The key derivation function is constructed based on the output feedback mode (OFB) of the AES encryption algorithm. In the output feedback mode, the AES algorithm is used to encrypt an internal state, which is equal to the length of the key. The state is updated after each encryption. The result of the concatenation of the session ID and the timestamp is used as the initialization vector, and it is input into the AES-OFB mode with the master key. In the OFB mode, the AES algorithm encrypts an internal state equal to the length of the key, and uses the encrypted result to perform heterogeneous operations with the plaintext to generate ciphertext. The session key is extracted from the final state of the AES-OFB mode to make it sufficiently random and unpredictable. The calculation formula is as follows:

[0084] ,in, Indicates that the session ID and timestamp They are connected in series as the input of the AES algorithm. Due to the characteristics of the AES algorithm and the working mode of OFB mode, each encryption will produce a random output. Since the input is composed of the session ID and the timestamp, this ensures that the key for each session is unique. OFB mode provides good security, especially under the premise of correct use, it can effectively resist various cryptanalysis attacks.

[0085] The dynamically adjusting encryption parameters based on the user access channel and the user risk level includes:

[0086] Identify the user access channel, and if the user access channel is the first channel, use basic security encryption;

[0087] If the user is the second channel, the number of bits of the master key is increased on the basis of basic security encryption, that is, ,in is a positive constant, used to represent the multiple of the number of bits of the second channel master key increased on the basis of the basic encryption. is the number of bits of the second channel master key;

[0088] The number of encryption layers is dynamically selected based on the risk level of the user when logging in. Based on the multi-layer encryption base L, the number of encryption layers is dynamically selected, including L layers of encryption for low risk levels and L layers of encryption for medium risk levels. L-layer encryption, high risk level L-layer encryption, where is a positive constant used to characterize the difference in the number of encryption layers for different risk levels;

[0089] In this embodiment, by dynamically adjusting encryption parameters based on user access channels and user risk levels, it is possible to more accurately match security requirements in different scenarios and ensure that the security of data during transmission and storage is optimized. Specifically, for users of the first channel, basic security encryption measures can ensure basic security; while for users of the second channel who may face higher risks, by increasing the number of bits of the master key and the number of encryption layers, the security of data transmission can be greatly improved to prevent potential threats. Similarly, the number of encryption layers is dynamically selected based on the risk level of the user when logging in, with 2 layers of encryption for low risk levels, 3 layers of encryption for medium risk levels, and 4 layers of encryption for high risk levels. Differentiated encryption strategies can effectively improve the overall security performance of the system without sacrificing performance.

[0090] The audit monitoring module is used to record users' access and operation behaviors to government documents in real time, and perform abnormal risk assessment on government documents based on log records. The abnormal risk assessment rates the log records of government documents through pattern recognition, issues abnormal risk warnings based on abnormal risk levels, and performs event tracing on government documents with abnormal risks. The pattern recognition establishes a behavioral pattern baseline for normal access through historical log records, and uses machine learning algorithms to identify log records that deviate from the behavioral pattern baseline. The machine learning algorithms include decision trees, random forests, and support vector machines.

[0091] The log records include file attributes: file level, file size, file creation time, file creator; operation information: operation type, operation user, operation time, operation IP address; user information: login time, logout time, operation behavior, file access, file operation;

[0092] The abnormal risk rating of the log records of government documents through pattern recognition, abnormal risk warning according to the abnormal risk level, and event tracing of government documents with abnormal risks include:

[0093] When a new record is added to the log, the user group is confirmed based on the user information of the new record, and based on the user group, the abnormal deviation between the new record and the behavior pattern baseline is calculated through the pattern recognition model trained by the group, and risk rating is performed based on the deviation;

[0094] See attached Figure 5, is a flowchart of risk rating warning, configuring the lower threshold Y1 and the upper threshold Y2, where the lower threshold Y1 is less than the upper threshold Y2. If the abnormal deviation is less than Y1, it is determined that the new record has no abnormal risk, which indicates that the operation behavior of the new record is within the reasonable range of the baseline deviation of the behavior pattern, and no abnormal risk warning is issued;

[0095] If the deviation is greater than or equal to Y1 and less than Y2, the newly added record is judged as a first-level abnormal risk, which indicates that the operation behavior of the newly added record has a small abnormal deviation from the behavior pattern baseline. A first-level abnormal risk warning is issued, and the government documents of the newly added record operation are locked. The government document warning information of the newly added record is sent to the responsible department, and the newly added record is marked as a first-level abnormal risk event;

[0096] If the deviation is greater than or equal to Y2, the newly added record is determined to be a secondary abnormal risk, which indicates that the operation behavior of the newly added record has a large deviation from the baseline of the behavior pattern. A secondary abnormal risk warning is issued, and the user account of the newly added record is locked, and it is marked as an abnormal risk user. All operations of the abnormal risk user are locked, and a time threshold Y3 is configured to characterize the traceability time range of the user's operation behavior. The log records of the risk user within the T3 time range are obtained, and the government documents of the user's operation are obtained and locked according to the log records. The warning information of the log records of the risk user is sent to the responsible department;

[0097] Monitor the behavior patterns of user groups with abnormal risk warnings, configure the time threshold Y4, which is used to characterize the time range for detecting user groups with abnormal risk warnings, detect the number of abnormal risk warnings that occur in user groups with abnormal risk warnings within the Y4 time period, and configure the warning threshold Y5. If the number of warnings is greater than Y5, review the user group, increase the monitoring intensity, and adjust the control measures within the user group.

[0098] In this embodiment, after the user obtains permission through the access control module, he operates on the government documents within the scope of permission. Each operation behavior forms a log record. When a new log record is added, the audit monitoring module performs a risk assessment on the new log record, and performs risk warning and event tracing based on the risk assessment results. By recording and analyzing user behavior in real time, and combining machine learning algorithms to establish a pattern recognition model, the security risk assessment of government documents is effectively performed. By accurately judging the risk level and timely risk warning, as well as tracing and adjusting control measures for risky users, government documents can be better protected to prevent data leakage or unauthorized access.

[0099] When a new record is added to the log, the user information of the user who performed the operation behavior is obtained from the log record, and the user group is located according to the user information. The user group is divided according to the collected historical log records. The collected historical log records are cleaned, deduplicated, and formatted, and feature information is extracted. The feature information includes access frequency, session duration, operation type, operation interval, and file type; the historical log records are divided into two categories: normal access and abnormal access, and a normal access training data set and an abnormal access training data set are constructed; based on the normal access training data set, the user behavior is grouped using the K-means algorithm to establish a normal access behavior baseline for different user groups; the pattern recognition model is trained according to the user grouping to learn the normal access and abnormal access behaviors of different user groups. The pattern recognition model is based on machine learning. The learning algorithm includes any one of a decision tree, a random forest, and a support vector machine, so that the pattern recognition model of each user group obtained by training can output the deviation value of the behavioral operation during abnormal access and the behavioral baseline of normal access, and perform risk rating according to the deviation value. For example, a random forest model is selected, which consists of n decision numbers, and samples are taken from the data sets of normal access and abnormal access respectively to construct a training set. According to the user groups, a suitable feature set is selected for each group, such as file access frequency, operation time distribution, IP address geographic location, operation type combination, etc.; the random forest model is trained according to the features, and each decision tree i of the random forest model will output a prediction value y(x) for the input feature vector x, and the final output result is composed of the average of the prediction values ​​of all decision trees.

[0100] The deviation between the newly added record and the baseline of the behavior pattern is calculated through the pattern recognition model trained in groups, and the risk rating is performed according to the deviation. If the deviation is less than Y1, the newly added record is judged to be risk-free, indicating that its operation behavior is within the normal variation range, and the risk warning will not be triggered at this time. This helps to reduce false alarms and unnecessary alarms and improve the reliability of the system. If the deviation is between Y1 and Y2, the newly added record is judged to be a first-level risk, indicating that the operation behavior deviates slightly from the normal mode. At this time, a first-level risk warning will be triggered, the relevant government documents will be locked, and the warning information will be sent to the responsible department. At the same time, these records will be marked as first-level risk events for subsequent event tracing and processing. If the deviation is greater than or equal to Y2, the newly added record is judged to be a second-level risk, indicating that the operation behavior has a significant deviation from the normal mode. This will trigger a second-level risk warning, and the user account involved will be locked and marked as a risk user. In addition, a time threshold Y3 will be set to track the user's operation history and lock the government documents operated by the user within the Y3 time. The log records and warning information of the risk user will also be sent to the responsible department. And continue to monitor the behavior patterns of user groups that already have risk warnings, and set a time threshold Y4 to determine the time range of monitoring. During the Y4 period, if the number of risk warnings in a user group exceeds the set warning threshold Y5, the users in this group will be further reviewed and monitored. At the same time, the access control measures for users in this group will be adjusted, such as limiting operation permissions and increasing approval processes, to improve security. Through continuous monitoring, timely warnings and timely intervention, abnormal behaviors and potential security threats can be effectively discovered, helping to protect the security of government documents. At the same time, it can also provide information about user behavior patterns to help organizations better understand the behavioral habits and potential risks of their internal personnel, so as to take corresponding preventive measures.

[0101] Working principle and effect:

[0102] A multi-dimensional factor security management system for government documents achieves a high level of protection for government documents by integrating multiple security modules. First, the identity authentication module uses multi-level authentication and risk assessment strategies to ensure that only authorized users can access the system. Then the access control module assigns specific access channels according to the user's risk level, thereby limiting the path and permissions for data access. The access encryption module dynamically encrypts data and adjusts encryption parameters according to the user's risk level and access channel to ensure the security of data transmission. Finally, the audit monitoring module records and analyzes user behavior in real time, warns of abnormal activities, and takes corresponding security measures.

[0103] The identity authentication module uses multi-level authentication and risk assessment strategies to confirm the user's identity. The user's risk level is determined by the user's login behavior score, including login time, frequency, and location, and the user login identification score, including the number of login attempts and the comprehensive score of error cause analysis. The access control module allocates different access channels according to the user's risk level. These channels have different levels of security and permission settings to ensure the security of sensitive information. The access encryption module dynamically encrypts the user's access operations and adjusts the encryption parameters based on the user's risk level and access channel. The master key is generated using a random number generator, and the session key is derived based on the session ID and timestamp to achieve multi-layer encryption and data integrity verification. The audit monitoring module records the user's access and operation behavior to government documents in real time, and performs abnormal risk assessment through pattern recognition technology. The machine learning algorithm is used to compare the deviation of log records from the normal behavior pattern baseline to perform risk rating and early warning. Through the collaborative work between modules, government documents can be effectively managed and protected to prevent unauthorized access and data leakage, while ensuring that legitimate users can efficiently access the required information.

[0104] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A multi-dimensional factor security management system for government documents, characterized in that: Including identity authentication module, access control module, access encryption module and audit monitoring module; The identity authentication module is used to confirm the user's identity through multi-level authentication when receiving a user's login request; The access control module is used to allocate user access channels according to the risk level of the user during login authentication, and the access channels are used to distinguish the security level and authority level of the data access path; The access encryption module is used to dynamically encrypt the access channel of the user access operation, and the dynamic encryption dynamically adjusts the encryption parameters based on the user access channel and the user risk level on the basis of the basic security encryption; The audit monitoring module is used to record the user's access and operation behavior on government documents in real time, and conduct abnormal risk assessment on government documents based on the log records; The multi-level authentication is provided with a risk assessment strategy, which is used to assess the authentication risk level of a user when logging in through identity authentication technology. The authentication risk level is obtained by a comprehensive score of multi-dimensional factor scores, which are obtained by the user login behavior score and the user login identification score; The user login behavior score, the acquisition step includes: Calculate the time deviation between the user's current login time and the most frequent login time period, then divide this deviation by the standard deviation threshold, take the square of the deviation and subtract it from the full score to obtain the login time score. The calculation formula is as follows: ,in, is the login time score, is the time deviation, is the standard deviation threshold, is the full score; Configure the time threshold T1, calculate the number of logins within the time period from login time T1, and compare it with the upper limit of normal login frequency. Reduce the score according to the excess ratio to obtain the login frequency score. The calculation formula is as follows: ,in, is the login frequency score, is the number of logins within the time period from login time T1, is the upper limit of normal login frequency, is the full score; Determine the geographical distance between the user's current login location and the frequently used login location, configure the distance threshold T2, and reduce the score every T2 according to the geographical distance between the current login location and the frequently used login location to obtain the login location score. The calculation formula is as follows: ,in, is the login location score, is the geographical distance between the current login location and the usual login location, is the rounding function, is the score reduction ratio, is the full score; The user login identification score, the acquisition step comprises: Record the number of login attempts A used by the user to successfully log in, and reduce the login score according to the login attempts, and configure the login score reduction ratio , to obtain the final login score, namely: ,in, is the login score, It is a full score, and failed login attempts will significantly affect the score, thus helping to identify potential brute force attacks; According to the reason for the login failure, the initial score is set, and it is stipulated that when the error occurs repeatedly, the score will be reduced by a certain percentage. The calculation formula is as follows: ,in, The jth login error reason occurs Login error score for each time, is the login error score, is the initial score of the jth login error reason, is the decreasing percentage of the jth login error reason, is the number of times the jth login error reason occurs, is the number of error causes, is the full score; The user login identification score acquisition step further includes: The user login identification score is calculated based on the login count score and the login error score through the weighted arithmetic average. The calculation formula is as follows: ,in, is the user login identification score, is the login score, is the login error score, and are the weights of the login count score and login error score respectively.

2. A multi-dimensional factor security management system for government documents as claimed in claim 1, characterized in that: The user login behavior score, the step of obtaining the user login behavior score further includes: The user behavior score is the reciprocal of the average of the reciprocals of the login time score, login frequency score, and login location score. The calculation formula is as follows: ,in, is the user behavior score, is the login time score, is the login frequency score, It is the login location score.

3. A multi-dimensional factor security management system for government documents as claimed in claim 1, characterized in that: The steps of confirming the user's identity include: A first identity authentication technology is selected through a multi-factor authentication mechanism, and the user identity is authenticated according to the first identity authentication technology; if the user is successfully authenticated through the first identity authentication technology, the authentication risk level of the user during authentication is obtained through a risk assessment strategy, and if the risk level is a low risk level, the authentication is successful; If the risk level is medium risk level, the second identity authentication technology is selected through the multi-factor authentication mechanism. If the user's second identity authentication technology is successfully authenticated, the authentication is successful, otherwise the authentication fails; If the risk level is high, the second identity authentication technology and the third identity authentication technology are selected through the multi-factor authentication mechanism. If the user's second identity authentication technology and the third identity authentication technology are both successfully authenticated, the authentication is successful, otherwise the authentication fails; The multi-factor authentication mechanism selects an identity authentication technology in the authentication library by a random selection method. The random selection method means that when a user initiates a login request, the identity authentication module selects an identity authentication technology in the authentication library based on a random principle.

4. A multi-dimensional factor security management system for government documents as claimed in claim 1, characterized in that: The basic security encryption includes: In the initialization phase, a master key is generated through a random number generator. , ,in, The seed used to represent random numbers. Indicates the number of bits of the master key, which is stored in the hardware module; When a user requests access, a session key is derived from the master key The life cycle of the session key is limited to the current session. The session key and encryption parameters are sent to the client and server. The calculation formula is as follows: ,in, is the key derivation function, is the session ID, is the session timestamp; During data transmission, the session key is used to perform multi-layer encryption on the data. For the multi-layer encryption, a multi-layer encryption base L is established, and the number of encryption layers is dynamically selected according to the risk level of the user when logging in; Use the session key to decrypt the data layer by layer and verify the integrity of the data. If the verification passes, use the session key to restore the original data. After the session ends, destroy the session key, clear the encrypted data in the memory, and update the master key regularly.

5. A multi-dimensional factor security management system for government documents as claimed in claim 4, characterized in that: The key derivation function is constructed based on the output feedback mode of the AES encryption algorithm, using the result of the concatenation of the session ID and the timestamp as the initialization vector, and inputting it and the master key into the AES-OFB mode. The calculation formula is as follows: in, Indicates that the session ID and timestamp Connect them in series and use them as input to the AES algorithm.

6. A government document multi-dimensional factor security management system as described in any one of claims 1 to 5, characterized in that: The dynamically adjusting encryption parameters based on the user access channel and the user risk level includes: Identify the user access channel, and if the user access channel is the first channel, use basic security encryption; If the user is the second channel, the number of bits of the master key is increased on the basis of basic security encryption, that is, ,in is a positive constant used to represent the multiple of the number of bits of the second channel master key increased on the basis of the basic encryption. is the number of bits of the second channel master key; The number of encryption layers is dynamically selected based on the risk level of the user when logging in. Based on the multi-layer encryption base L, the number of encryption layers is dynamically selected, including L layers of encryption for low risk levels and L layers of encryption for medium risk levels. L-layer encryption, high risk level L-layer encryption, where It is a positive constant used to represent the difference in the number of encryption layers for different risk levels.

Images