A secure access control method and system suitable for cloud computing environment

Abstract

The present invention relates to the field of digital information transmission technology, and specifically to a security access control method and system suitable for a cloud computing environment, which specifically includes obtaining user access attribute data; obtaining access characteristics corresponding to each user based on the access attribute data; obtaining access anomalies corresponding to each user based on the access characteristics of all users; and screening out marked users with abnormal access risks from all users based on the access anomalies of all users, and adjusting the access rights of marked users. The present disclosure proposes an intelligent and dynamic permission management method, which can effectively prevent potential security threats and data leakage risks in a cloud computing environment by monitoring the user's access behavior in real time, timely identifying the abnormal access risks that may exist in the user and adaptively adjusting the corresponding user's access rights, while greatly reducing the abuse of permissions, and has promotional value.

Description

Technical Field

[0001] The present disclosure relates to the technical field of digital information transmission, and in particular to a secure access control method and system applicable to a cloud computing environment. Background Art

[0002] With the rapid development of cloud computing technology, more and more enterprises and organizations are migrating their core businesses and data to cloud platforms, hoping to benefit from the flexibility, scalability, and cost-effectiveness of cloud computing. However, this shift has also raised profound concerns about data security and privacy protection. This is especially true in scenarios involving sensitive information, where ensuring only authorized users can access this data becomes crucial. The characteristics of cloud computing environments, such as multi-tenant architectures, extensive network access, and dynamic resource allocation, make traditional access control methods ineffective in addressing increasingly complex security challenges. Therefore, how to achieve refined secure access control while maintaining flexibility has become a pressing issue in the cloud computing field.

[0003] In existing technologies, user access permissions are managed using static access control lists (ACLs). As can be understood, an Access Control List (ACL) is a mechanism for managing and controlling access permissions to computer systems, networks, or file resources. It serves as a data structure that defines which users or user groups can access specific resources and their permissions to operate on those resources. Static ACLs cannot dynamically adjust access permissions based on changes in actual access conditions, such as user roles, access times, and geographic locations. They lack flexibility and dynamic response mechanisms, making them difficult to adapt to the refined security access control requirements of rapidly changing cloud computing environments. Summary of the Invention

[0004] In order to solve the technical problems raised in the background technology, the purpose of this disclosure is to provide a secure access control method and system applicable to a cloud computing environment. The technical solutions adopted are as follows:

[0005] A first aspect of the present disclosure provides a secure access control method applicable to a cloud computing environment, which may specifically include the following steps:

[0006] Acquiring user access attribute data, wherein the access attribute data includes static attribute data associated with the user and dynamic attribute data associated with the access behavior;

[0007] Based on the access attribute data, obtain the access characteristics corresponding to each user;

[0008] Based on the access characteristics of all users and the corresponding access attribute data, obtain the access anomaly corresponding to each user;

[0009] Based on the access anomalies of all users, marked users with abnormal access risks are screened out from all users, and the access rights of the marked users are adjusted. The access rights of the marked users after the adjustment are less than the access rights before the adjustment.

[0010] In a possible implementation of the first aspect, the static attribute data includes user identity information and initial user access permission information:

[0011] The dynamic attribute data includes at least one or more combinations of access time information, access address information, access resource record information, access operation record information, access session record information and abnormal access behavior information corresponding to the access behavior.

[0012] In a possible implementation of the first aspect, the process of obtaining access characteristics corresponding to each user based on access attribute data includes the following steps:

[0013] Based on the access attribute data, a plurality of access habit indicators of the corresponding user are obtained, each access habit indicator corresponds to a secure access scenario, and each access habit indicator corresponds to a value;

[0014] All access habit indicators of each user are summed up to obtain the access characteristic value corresponding to each user, and the access characteristic value is used as the access characteristic situation.

[0015] In a possible implementation of the first aspect, the access habit indicator includes an identity authentication anomaly indicator, and the identity authentication anomaly indicator is represented by a ratio of the number of user identity authentication errors to the total number of user identity authentication attempts within a preset period of time.

[0016] and / or

[0017] The access habit index includes an access operation complexity index, which is represented by the product of the number of user access operations and the number of access data types within a preset period.

[0018] In a possible implementation of the first aspect, the process of obtaining the access abnormality corresponding to each user based on the access characteristics of all users includes the following steps:

[0019] Arrange the access feature values ​​of all users in ascending order to obtain an access feature value sequence;

[0020] Clustering the access feature value sequence based on the hierarchical clustering algorithm to obtain multiple feature clustering clusters;

[0021] Based on the access feature values ​​and access habit indicators of each user in different feature clusters, the access outlier value corresponding to each user is obtained. The access outlier value is associated with the ratio of the mean access feature value of the feature cluster to the mean access feature value of all users, as well as the ratio of the variance of each user's access habit indicator to the corresponding access habit indicator in the same feature cluster.

[0022] Treat access outliers as access exceptions.

[0023] In a possible implementation of the first aspect, the process of screening out marked users with abnormal access risks from all users based on access anomalies of all users includes the following steps:

[0024] Obtain the quartile judgment value corresponding to each user based on the median of the access anomaly values ​​of all users and the access anomaly value of each user;

[0025] Clustering is performed based on the quartile judgment value corresponding to each user to obtain multiple abnormal clusters;

[0026] According to the quartile judgment value corresponding to the users in each abnormal cluster, the quartile range of each abnormal cluster is obtained and a box plot is constructed;

[0027] The users corresponding to the access outliers that are not in the box and its preset extension in the box plot are marked as users with abnormal access risks.

[0028] In a possible implementation of the first aspect above, the security access control method further includes the following steps:

[0029] Initiate an identity authentication request for a user marked as having abnormal access risk. The identity authentication request includes at least two identity authentication paths.

[0030] When the user is marked as having passed the identity authentication process corresponding to the identity authentication request, the user is informed of the adjusted content and / or reason for the access rights.

[0031] In a possible implementation of the first aspect above, the security access control method further includes the following steps:

[0032] Regularly update the access characteristics of marked users and determine whether the marked users continue to have abnormal access risks based on the updated access characteristics;

[0033] Restoring or partially restoring the marked user's access rights if the marked user does not pose any abnormal access risk; or

[0034] If the marked user does not have abnormal access risks and passes the identity authentication process corresponding to the identity authentication request, the access rights of the marked user are restored or partially restored.

[0035] In a possible implementation of the first aspect above, the security access control method further includes the following steps:

[0036] Accept access permission adjustment requests from users marked as having abnormal access risks;

[0037] In the case that the marked user passes the identity authentication process corresponding to the identity authentication request, the access rights of the marked user are restored or partially restored according to the access right adjustment request based on the access attribute data of the marked user.

[0038] A second aspect of the present disclosure provides a secure access control system applicable to a cloud computing environment, for implementing the secure access control method applicable to a cloud computing environment provided in the first aspect, which may specifically include:

[0039] An access attribute data acquisition unit, configured to acquire the user's access attribute data, the access attribute data including static attribute data associated with the user and dynamic attribute data associated with the access behavior;

[0040] An access characteristic acquisition unit, configured to acquire the access characteristic corresponding to each user based on the access attribute data;

[0041] An access anomaly acquisition unit, configured to acquire an access anomaly corresponding to each user based on the access characteristics of all users and the corresponding access attribute data;

[0042] The access permission adjustment unit is used to screen out marked users with abnormal access risks from all users based on the access abnormalities of all users, and adjust the access permissions of the marked users. The access permissions of the marked users after adjustment are less than the access permissions before adjustment.

[0043] Compared with the background technology, the present disclosure has the following beneficial effects:

[0044] The technical solution provided by this disclosure can obtain the user's corresponding access characteristics based on the user's access behavior and access logs over a period of time; compare the differences between users in the same cloud computing environment based on the correlation between the access characteristics to obtain the user's corresponding access anomalies; and finally, based on the analysis of the access anomalies, screen out users with abnormal access risks and adjust their permissions. This disclosure proposes an intelligent and dynamic permission management method. By monitoring the user's access behavior in real time, it can promptly identify the user's possible abnormal access risks and adaptively adjust the corresponding user's access rights. It can effectively prevent potential security threats and data leakage risks in the cloud computing environment, while greatly reducing the abuse of permissions, and has promotional value. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 According to an embodiment of the present disclosure, a flowchart of a secure access control method applicable to a cloud computing environment is provided.

[0047] Figure 2 According to an embodiment of the present disclosure, a flowchart of obtaining access characteristics corresponding to each user based on access attribute data is provided.

[0048] Figure 3 According to an embodiment of the present disclosure, a flowchart is provided for obtaining access anomalies corresponding to each user based on access characteristics of all users.

[0049] Figure 4 According to an embodiment of the present disclosure, a flowchart is provided for screening out marked users with abnormal access risks from all users based on the access abnormalities of all users.

[0050] Figure 5 According to an embodiment of the present disclosure, a structural diagram of a secure access control system suitable for a cloud computing environment is provided. DETAILED DESCRIPTION

[0051] To further illustrate the technical means and effectiveness of the present invention in achieving its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail a secure access control method for cloud computing environments, including its specific implementation, structure, features, and effectiveness. In the following description, references to different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0052] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0053] In response to the problems raised in the background technology, the present disclosure provides a method and system for secure access control in a cloud computing environment, which can realize intelligent and dynamic rights management in a cloud computing environment. Specifically, in some embodiments of the present disclosure, Figure 1 The figure shows a flow chart of a secure access control method applicable to cloud computing environment. Figure 1 As shown, this method may specifically include the following steps:

[0054] Step 100: Obtain the user's access attribute data. Unlike the static access control lists commonly used in the background art, the access attribute data obtained in this embodiment includes both static attribute data associated with the user and dynamic attribute data associated with access behavior. This accurately reflects the user's normal access habits based on their access behavior over a period of time, laying the foundation for subsequent dynamic screening of abnormal access users. The specific content of the access attribute data will be described in detail below.

[0055] Step 200: Based on the access attribute data, obtain the access characteristics corresponding to each user. The specific acquisition of the access characteristics will be described in detail later.

[0056] Step 300: Based on the access characteristics of all users and the corresponding access attribute data, obtain the access anomaly corresponding to each user. It is understandable that in an interactive system corresponding to the same cloud computing environment, the data types accessed by different individual users and the specific operations they perform in the interactive system vary. However, since the various functional modules of the interactive system are relatively fixed during an update cycle, and as the number of accessing users increases, the access data between normal accessing users will be correlated. This can be understood as a correlation between the access characteristics obtained in the aforementioned step 200. At the same time, since the access anomaly of each user needs to be obtained through a comprehensive evaluation of multiple access attribute data, the access attribute data and access characteristics obtained in the aforementioned steps 100 and 200 need to be comprehensively utilized for analysis in the process of obtaining the access anomaly corresponding to each user. The specific acquisition of the access anomaly will be explained in detail later.

[0057] Step 400: Based on the access anomalies of all users, screen out marked users with abnormal access risks from all users, and adjust the access rights of the marked users. It can be understood that, since marked users have abnormal access risks, in the permission adjustment of the above step 400, the permissions of the marked users are adjusted from a large range to a small range, that is, the access rights of the marked users after adjustment are less than the access rights of the marked users before adjustment. In an optional specific implementation of the above embodiment, the adjustment of access rights can be to temporarily adjust the marked users from "normal access users" to "restricted access users" instantly. At this time, the marked users will not be able to access any sensitive data and functions in the cloud computing environment, thereby avoiding the risk of core data leakage at the root.

[0058] It can be understood that through the above steps 100 to 400, it is possible to dynamically limit and adjust user access rights based on their access behavior in a cloud computing environment, effectively preventing potential security threats and data leakage risks in the cloud computing environment. The specific implementation of the above steps 100 to 400 will be further explained below.

[0059] In the above embodiment, in the specific implementation of the aforementioned step 100, the static attribute data may include user identity information and initial user access permission information. It is understood that in the process of controlling access permissions in the disclosed embodiment, it is necessary to pre-identify the identity of the accessing user. Therefore, the static attribute data includes relatively fixed user identity information. The user identity information may further include the user name, the user's corresponding virtual character, and user identity authentication information, such as the user password, face recognition, fingerprint recognition, voiceprint recognition, etc., which are not limited here. The initial user access permission information can be pre-set through an access control list or other means to limit the user's initial accessible scope and executable operations.

[0060] In the above embodiment, in the specific implementation of the aforementioned step 100, the dynamic attribute data may include a combination of at least one or more of the following: access time information, access address information, access resource record information, access operation record information, access session record information, and abnormal access behavior information corresponding to the access behavior. The access time information may include recording when the user logs in and out of the system, thereby enabling monitoring and security auditing of the user's access time period; the access address information may include information such as the IP address used by the user to access the cloud computing environment through a terminal device, thereby enabling monitoring and security auditing of the user's access address; the access resource record information may include the user's access to resources and / or services of the interactive system corresponding to the cloud computing environment, such as computing instances, storage buckets, databases, etc.; the access operation record information may include specific operations performed by the user in the interactive system corresponding to the cloud computing environment, such as creating, modifying, and deleting resources; the access session record information may include the duration and status of the user's session in the interactive system corresponding to the cloud computing environment; and the abnormal access behavior information may include monitoring of abnormal user behavior, such as multiple failed login attempts. By collecting the above dynamic attribute data, it is possible to reflect all specific access behaviors of users in the interactive system corresponding to the cloud computing environment within a period of time, laying a data foundation for subsequently obtaining the user's access habits and access characteristics.

[0061] It is understandable that the above dynamic attribute data can be obtained by regularly acquiring the user's access log based on a preset period of time, which is not limited here.

[0062] In the above embodiment, in the specific implementation of the aforementioned step 200, Figure 2 A schematic diagram of a process for obtaining access characteristics corresponding to each user based on access attribute data is shown. Figure 2 As shown, the following steps may be specifically included:

[0063] Step 201: Based on the access attribute data, multiple access habit indicators of the corresponding user are obtained. Each access habit indicator corresponds to a secure access scenario and a numerical value. It is understood that by collecting and monitoring user access attribute data over a certain period of time, the user's access habits can be obtained accordingly. If a user's access operations significantly deviate from those of other users with similar access habits, the user can be considered to have a corresponding abnormal access risk.

[0064] For example, in an optional specific implementation of the present disclosure, the access habit indicator may include an identity authentication anomaly indicator. It is understood that when users log into a cloud computing environment, they need to perform identity authentication verification, such as password verification. The accuracy of identity authentication verification directly reflects the user's access anomaly. The identity authentication anomaly indicator can be represented by the ratio of the number of user access identity authentication errors to the total number of user access identity authentications within a preset time period. A larger ratio indicates a greater proportion of user identity authentication errors, and accordingly, a higher probability of abnormal access risk.

[0065] For example, in another optional specific implementation of the present disclosure, the access habit index may also include an access operation complexity index. It is understandable that when a user operates in a cloud computing environment, different access permission ranges will cover different access data contents and permissible operations. Therefore, the user's operation complexity can be determined based on the complexity of the user's access data. The more data or functions a user accesses and / or the more operation commands executed, the higher the user's operation complexity, and the corresponding probability of abnormal access risk is relatively higher. The access operation complexity index can be represented by the product of the number of user access operations and the number of access data types within a preset time period.

[0066] It is understandable that in order to facilitate subsequent data processing, each access habit indicator is quantified into a numerical type for representation, and the size of the numerical value has the same correlation with the risk of abnormal access, that is, the larger the numerical value corresponding to the access habit indicator, the higher the probability that the user has an abnormal access risk.

[0067] Step 202: Sum all access habit indicators of each user to obtain the access characteristic value corresponding to each user, and use the access characteristic value as the access characteristic situation. Specifically, the access characteristic value corresponding to each user can be obtained based on the following formula:

[0068]

[0069] in, Characterization The access feature value corresponding to each user, Characterization User's Access habit indicators, Characterization The number of access habit indicators corresponding to each user.

[0070] In the above embodiment, in the specific implementation of the aforementioned step 300, Figure 3 The figure shows a flow chart of obtaining the access abnormality corresponding to each user based on the access characteristics of all users. Figure 3 As shown, the following steps may be specifically included:

[0071] Step 301: Arrange the access feature values ​​of all users in ascending order to obtain an access feature value sequence. It is understood that when obtaining the access feature value corresponding to each user, these access feature values ​​can be arranged in ascending order to obtain the following feature value sequence:

[0072] .

[0073] Step 302: Cluster the accessed feature value sequence based on a hierarchical clustering algorithm to obtain multiple feature clusters. When a feature value sequence is obtained, a hierarchical clustering algorithm can be used to cluster the feature value sequence to obtain multiple feature clusters corresponding to the feature value sequence. Those skilled in the art can select an appropriate clustering algorithm based on actual needs, and this is not limited here.

[0074] Step 303: Based on the access feature values ​​and access habit indicators of each user in different feature clusters, obtain the access anomaly value corresponding to each user, and use the access anomaly value as the access anomaly. The access anomaly value is associated with the ratio of the mean access feature value of the user's feature cluster to the mean access feature value of all users, as well as the ratio of the variance of each user's access habit indicator to the corresponding access habit indicator in the same feature cluster. Specifically, the access anomaly value corresponding to each user can be obtained based on the following formula:

[0075]

[0076] in, Characterization The abnormal feature value corresponding to each user, Characterization The user's The mean of the access feature values ​​of all users in the feature cluster, Characterizes the mean of the access feature values ​​of all users, Characterization User's Access habit indicators, Characterization The number of access habit indicators corresponding to each user, Characterization in the The first feature cluster The variance of the access habit indicator, Characterizes the linear normalization function. It can be understood that Characterization The ratio of the mean of the access feature values ​​of the users in a feature cluster to the mean of the access feature values ​​of all users. The larger the ratio, the more abnormal the access of the feature cluster to which the current user belongs. In this case, when controlling the access rights of the user, the requirements and degree of control need to be more adaptable. The greater the difference in access habit indicators among similar user groups that characterize a specific user, the greater the difference, indicating that there are also greater differences in access habit indicators among similar user groups, and therefore the greater the degree of access anomaly of the specific user.

[0077] In the above embodiment, in the specific implementation of the aforementioned step 400, Figure 4 The following is a flow chart showing a method for screening out users with abnormal access risks from all users based on the abnormal access conditions of all users. Figure 4 As shown, the following steps may be specifically included:

[0078] Step 401: Based on the median of all users' access outlier values ​​and each user's access outlier value, obtain the quartile judgment value corresponding to each user. It will be appreciated that in the embodiments provided herein, a boxplot algorithm is used to analyze user access anomalies. This algorithm effectively displays the central tendency and dispersion of data and is composed of five key statistics: the minimum value, the first quartile (Q1), the median (Q2), the third quartile (Q3), and the maximum value. The box represents the middle 50% of the data (interquartile range (IQR)) and extends to a range of no more than 1.5 times the IQR. Data points outside this range are considered outliers.

[0079] Specifically, the quartile judgment value corresponding to each user can be obtained based on the following formula:

[0080]

[0081] in, Characterization The quartile judgment value corresponding to each user is Characterization The access outlier value corresponding to the user, Characterizes the median of access outliers for all users, Represents the number of all users, Characterizes the exponential function with a natural constant as the base. It can be understood that Characterization The closer the difference between an individual user's access outlier and the median of all users' access is to 0, the closer the user's access outlier is to the overall middle level. In the subsequent boxplot construction process, the user's access outlier is closer to the middle area of ​​the boxplot. Characterization The ratio of an individual user's access anomaly value to the sum of all access anomaly values. The larger the ratio, the more the current user deviates from the normal access pattern, and the greater the corresponding access anomaly degree.

[0082] Step 402: Clustering is performed based on the quartile judgment value corresponding to each user to obtain multiple abnormal clusters. In an optional implementation of the present disclosure, a K-means clustering algorithm can be used, with K=5 preset. After clustering, five abnormal clusters will exist. The K-means clustering algorithm is common knowledge understood by those skilled in the art and will not be described in detail here.

[0083] Step 403: Based on the quartile judgment value corresponding to the users in each abnormal cluster, obtain the quartile range of each abnormal cluster and construct a box plot. Specifically, the quartile range corresponding to each abnormal cluster can be as follows:

[0084]

[0085] in, Characterization The interquartile range of the clusters. Characterization The minimum value of the quartile judgment value of the clusters, Characterization The maximum value of the quartile judgment value of the clusters, Characterization The minimum value of the quartile judgment value corresponding to the clusters.

[0086] Step 404: Users with access outliers that are not within the box or its pre-set extension in the boxplot are marked as users with abnormal access risk. It will be appreciated that by constructing a boxplot based on the interquartile range obtained in step 403, marked users with abnormal access risk can be obtained. The boxes in the boxplot represent the middle 50% of the data (interquartile range (IQR)) and extend to a range of no more than 1.5 times the IQR. Users with access outliers outside this range are marked as users.

[0087] In the above embodiment, further, in the specific implementation of step 400, an identity authentication request may be initiated for a marked user who presents an abnormal access risk, requiring the marked user to verify their identity through multi-factor authentication. Therefore, the identity authentication request may include at least two identity authentication paths to ensure the security and integrity of the identity authentication. If the marked user passes the identity authentication process corresponding to the identity authentication request, the user may be informed of the content and / or reason for the access rights adjustment.

[0088] In the above embodiment, further, in the specific implementation of the aforementioned step 400, the access characteristics corresponding to the marked user can be updated regularly, and based on the updated access characteristics, it can be determined whether the marked user continues to have abnormal access risks; if the marked user does not have abnormal access risks, the access rights of the marked user can be restored or partially restored; or if the marked user does not have abnormal access risks and passes the identity authentication process corresponding to the identity authentication request, the access rights of the marked user can be restored or partially restored. It is understandable that when the marked user is obtained, the permission adjustment actions of the marked user can be recorded, including the abnormal identification time, detailed information on the adjusted permissions, etc., for subsequent auditing and analysis; at the same time, a scheduled task can be set to regularly evaluate the user's behavior to determine whether its permissions can be restored, thereby ensuring the security of the cloud computing environment while taking into account the user's usage experience.

[0089] In the above embodiment, further, in the specific implementation of the aforementioned step 400, it is also possible to accept the marked user who has abnormal access risk to actively initiate an access permission adjustment request: when the marked user passes the identity authentication process corresponding to the identity authentication request, based on the access attribute data of the marked user, the access permission of the marked user is restored or partially restored according to the access permission adjustment request.

[0090] In some embodiments of the present disclosure, Figure 5 This paper provides a schematic diagram of the structure of a secure access control system suitable for cloud computing environments. Figure 5 As shown, this type of security access control system is used to implement the security access control method applicable to a cloud computing environment provided in the aforementioned embodiment, and may specifically include:

[0091] The access attribute data acquisition unit 001 is used to acquire the user's access attribute data, wherein the access attribute data may also include static attribute data associated with the user and dynamic attribute data associated with the access behavior.

[0092] The access characteristic acquisition unit 002 is used to acquire the access characteristic corresponding to each user based on the access attribute data.

[0093] The access abnormality obtaining unit 003 is configured to obtain the access abnormality corresponding to each user based on the access characteristics of all users.

[0094] The access rights adjustment unit 004 is used to screen out marked users with abnormal access risks from all users based on the access abnormalities of all users, and adjust the access rights of the marked users. The access rights after adjustment are smaller than the access rights before adjustment.

[0095] It is understandable that the functions implemented by the access attribute data acquisition unit 001 to the access permission adjustment unit 004 in the above functional modules correspond one-to-one to the actions performed in the above steps 100 to 400, and are not described in detail here.

[0096] In summary, the technical solution provided by the present disclosure can obtain the user's corresponding access characteristics based on the user's access behavior and access logs over a period of time; and compare the differences between users in the same cloud computing environment based on the correlation between the access characteristics to obtain the user's corresponding access anomalies; finally, based on the analysis of the access anomalies, users with abnormal access risks are screened out and their permissions are restricted and adjusted. The present disclosure proposes an intelligent and dynamic permission management method. By monitoring the user's access behavior in real time, it can promptly identify the user's possible abnormal access risks and adaptively adjust the corresponding user's access rights. It can effectively prevent potential security threats and data leakage risks in the cloud computing environment, while greatly reducing the abuse of permissions, and has promotional value.

[0097] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0098] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A secure access control method suitable for cloud computing environment, characterized in that: The security access control method comprises the following steps: Acquire access attribute data of the user, wherein the access attribute data includes static attribute data associated with the user and dynamic attribute data associated with the access behavior; Based on the access attribute data, obtaining access characteristics corresponding to each user; Based on the access characteristics of all users and each corresponding access attribute data, obtaining the access abnormality corresponding to each user; Based on the access abnormalities of all users, screen out marked users with abnormal access risks from all users, and adjust the access rights of the marked users, wherein the access rights of the marked users after adjustment are less than the access rights of the marked users before adjustment; The process of obtaining the access characteristic situation corresponding to each user includes the following steps: based on the access attribute data, obtaining multiple access habit indicators of the corresponding user, each of which corresponds to a security access scenario, and each of which corresponds to a numerical value; summing up all the access habit indicators of each user to obtain the access characteristic value corresponding to each user, and using the access characteristic value as the access characteristic situation; Among them, the process of obtaining the access anomaly corresponding to each user includes the following steps: arranging the access feature values ​​of all users in ascending order to obtain an access feature value sequence; clustering the access feature value sequence based on a hierarchical clustering algorithm to obtain multiple feature clustering clusters; obtaining the access anomaly value corresponding to each user based on the access feature value and the access habit index of each user in different feature clustering clusters, the access anomaly value associated with the ratio of the mean access feature value of the feature clustering cluster to which the user belongs to and the mean access feature value of all users, and the ratio of each of the user's access habit index to the variance of the corresponding access habit index in the same feature clustering cluster; taking the access anomaly value as the access anomaly; Among them, the process of screening out marked users with abnormal access risks from all users includes the following steps: obtaining the quartile judgment value corresponding to each user according to the median of the access abnormal values ​​of all users and the access abnormal value of each user; clustering according to the quartile judgment value corresponding to each user to obtain multiple abnormal clustering clusters; according to the quartile judgment value corresponding to the user in each abnormal clustering cluster, obtaining the quartile range to which each abnormal clustering cluster belongs and constructing a box plot; taking the users corresponding to the access abnormal values ​​that are not in the box and its preset extension in the box plot as the marked users with abnormal access risks; Among them, an identity authentication request is initiated for a marked user with abnormal access risk, and the identity authentication request includes at least two identity authentication paths; when the marked user passes the identity authentication process corresponding to the identity authentication request, the user is informed of the adjustment content and / or reason for the access permission.

2. The secure access control method applicable to a cloud computing environment according to claim 1, characterized in that: The static attribute data includes user identity information and initial user access permission information: The dynamic attribute data includes at least one or more combinations of access time information, access address information, access resource record information, access operation record information, access session record information and abnormal access behavior information corresponding to the access behavior.

3. The secure access control method applicable to a cloud computing environment according to claim 1, characterized in that: The access habit index includes an identity authentication anomaly index, which is represented by the ratio of the number of user access identity authentication errors to the total number of user access identity authentication within a preset period of time; and / or The access habit index includes an access operation complexity index, and the access operation complexity index is represented by the product of the number of access operations of the user and the number of access data types within a preset period.

4. The secure access control method applicable to a cloud computing environment according to claim 1, characterized in that: The following steps are also included: Regularly updating the access characteristic situation corresponding to the marked user, and judging whether the marked user continues to have abnormal access risks according to the updated access characteristic situation; If there is no abnormal access risk for the marked user, restore or partially restore the access rights of the marked user; or When the marked user does not have abnormal access risk and passes the identity authentication process corresponding to the identity authentication request, the access rights of the marked user are restored or partially restored.

5. The secure access control method applicable to a cloud computing environment according to claim 1, characterized in that: The following steps are also included: Accept access permission adjustment requests from users marked as having abnormal access risks; In a case where the marked user passes the identity authentication process corresponding to the identity authentication request, based on the access attribute data of the marked user, the access rights of the marked user are restored or partially restored according to the access right adjustment request.

6. A security access control system applicable to a cloud computing environment, used to implement the security access control method applicable to a cloud computing environment as claimed in any one of claims 1 to 5, characterized in that: include: An access attribute data acquisition unit, used to acquire the user's access attribute data, wherein the access attribute data includes static attribute data associated with the user and dynamic attribute data associated with the access behavior; An access characteristic acquisition unit, used to acquire the access characteristic corresponding to each user based on the access attribute data; An access abnormality acquisition unit, used to acquire the access abnormality corresponding to each user based on the access characteristic conditions of all users and each corresponding access attribute data; The access permission adjustment unit is used to screen out marked users with abnormal access risks from all users based on the access abnormalities of all users, and adjust the access permissions of the marked users, wherein the access permissions of the marked users after adjustment are less than the access permissions of the marked users before adjustment.

Images