A method and system for managing access rights to financial data

Abstract

The present invention discloses a method and system for managing access rights of financial data, including: obtaining financial data evaluation instances, constructing attribute level evaluation rules with business attributes, access attributes and sensitive attributes as categories; obtaining financial data attribute features corresponding to each financial data and classifying the financial data, and evaluating the importance of each financial data in combination with the attribute level evaluation rules; reclassifying the financial data in the financial database based on the importance evaluation results, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database; constructing an access decision model to analyze access behavior of real-time access requests, generating access request feedback information for access response; setting a risk perception mechanism, performing risk monitoring on user access behavior based on the risk perception mechanism, and adjusting user trust at the same time. The flexibility of authority relations and dynamic adjustment capabilities are improved to ensure the security of authority access.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a method and system for managing access rights to financial data. Background Art

[0002] In current financial data management, traditional financial data access rights management methods often rely on static rights configuration, lack flexibility and dynamic adjustment capabilities, and are difficult to adapt to complex and changing business scenarios and security requirements. Traditional rights management methods usually implement data access control through predefined roles and permissions, but this method is inadequate when faced with complex and changing business scenarios. On the other hand, traditional rights management methods lack real-time monitoring and risk perception capabilities for user access behavior, making it difficult to promptly discover and prevent potential security risks.

[0003] Therefore, with the continuous expansion of the scale of financial business and the rapid growth of data volume, how to effectively and securely manage financial data access rights has become an urgent problem that needs to be solved. Summary of the invention

[0004] The present invention overcomes the defects of the prior art and provides a method and system for managing access rights of financial data, the important purpose of which is to improve the flexibility and dynamic adjustment capability of access rights management.

[0005] To achieve the above objectives, the present invention provides a method for managing access rights to financial data in a first aspect, comprising:

[0006] Obtain financial data evaluation instances based on data retrieval, and construct attribute level evaluation rules based on business attributes, access attributes, and sensitive attributes;

[0007] Acquire a financial database, extract financial data attribute features corresponding to each financial data in the financial database and classify the financial data, evaluate the importance of each financial data in combination with an attribute level evaluation rule, and obtain financial data importance evaluation information;

[0008] Reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database;

[0009] Obtain real-time access request information, build an access decision model to analyze the access behavior of the target user's real-time access request, and generate access request feedback information for access response;

[0010] Set up a risk perception mechanism, monitor user access behavior based on the risk perception mechanism, and adjust user trust according to the risk monitoring results.

[0011] In this solution, the financial data evaluation instance is obtained based on data retrieval, and attribute level evaluation rules are constructed with business attributes, access attributes and sensitive attributes as categories, specifically including:

[0012] Obtain financial data evaluation instances based on data retrieval, perform feature extraction on each financial data evaluation instance, and obtain evaluation indicators of business attributes, access attributes, and sensitive attributes of each financial data evaluation instance;

[0013] According to the extracted evaluation indicators, three types of evaluation indicator data sets are formed, namely, business attribute evaluation indicator data set, access attribute evaluation indicator data set and sensitive attribute evaluation indicator data set;

[0014] The usage frequency of each evaluation indicator in the evaluation indicator data set of different categories is counted and sorted, and a business attribute evaluation indicator sorting table, an access attribute evaluation indicator sorting table, and a sensitive attribute evaluation indicator sorting table are generated. The evaluation indicators of each attribute feature are screened to obtain the attribute feature evaluation indicator information;

[0015] Obtaining evaluation results corresponding to business attribute features, access attribute features, and sensitive attribute features in each financial data evaluation instance, and extracting evaluation parameters of each evaluation index based on the attribute feature evaluation index information and associating them with the evaluation results of each attribute feature;

[0016] The associated results based on the evaluation results, evaluation indicators and evaluation parameters respectively constitute the attribute level evaluation rules of business attribute characteristics, access attribute characteristics and sensitive attribute characteristics.

[0017] In this solution, the acquisition of a financial database, extraction of financial data attribute features corresponding to each financial data in the financial database and classification of the financial data, and evaluation of the importance of each financial data in combination with an attribute level evaluation rule specifically include:

[0018] Acquire a financial database, extract financial data attribute characteristics corresponding to each financial data in the financial database, including business attribute characteristics, access attribute characteristics and sensitive attribute characteristics, and obtain financial data attribute characteristic information;

[0019] Generate an attribute feature matrix corresponding to each financial data according to the attribute feature information of the financial data, and calculate the Euclidean distance between the attribute feature matrices of each financial data;

[0020] Introducing the K-means clustering algorithm, presetting the number of cluster centers, and classifying the financial data in the financial database according to the Euclidean distance value between the attribute feature matrices of each financial data;

[0021] Perform multiple iterations of aggregation until all financial data are divided, output several financial data sets, extract features from each financial data set, and obtain the attribute feature matrix of each financial data set;

[0022] Generate corresponding financial data category representations according to the attribute feature matrix of each financial data set, wherein the financial data category representations are composed of business attribute features, access attribute features and sensitive attribute features of the corresponding data set, and obtain financial data classification information;

[0023] Based on the financial data classification information, the attribute level of each financial data set is evaluated using the constructed attribute level evaluation rules, including the business attribute level, the access attribute level and the sensitive attribute level;

[0024] Perform weighted average calculation on the evaluation results of each attribute level of each financial data set, obtain the data importance of the corresponding financial data set according to the calculation results, and obtain the financial data importance evaluation information;

[0025] The financial data importance evaluation information includes four importance evaluation levels, namely extremely important, important, medium and ordinary.

[0026] In this solution, the financial data in the financial database is reclassified based on the financial data importance evaluation information, and authority allocation, role setting and attribute association are performed according to the reclassification results to generate an authority configuration database, which specifically includes:

[0027] Acquire financial data importance evaluation information, and acquire importance evaluation features of each financial data in the financial database according to the financial data importance evaluation information to obtain first analysis information;

[0028] Based on the first analysis information, the importance evaluation feature of the financial data is used as a classification basis to reclassify the financial data in the financial database to obtain reclassification result information;

[0029] Constructing independent permissions corresponding to financial data of different importance levels according to the reclassification result information, and combining permissions based on the constructed independent permissions to obtain combined permissions, and combining the combined permissions and the independent permissions to form a permission set;

[0030] Generate a permission role set according to the permission set, the permission role set including: first-level permission role, second-level permission role, third-level permission role and fourth-level permission role;

[0031] Preset access permission attributes and access control permission attributes, perform permission role attribute allocation in combination with the permission role set, and generate an access permission role attribute set and an access control permission role attribute set;

[0032] A mapping rule between attributes, roles and permissions is established according to the access permission role attribute set and the access control permission role attribute set, and a permission configuration database is generated.

[0033] In this solution, the real-time access request information is obtained, an access decision model is constructed to analyze the access behavior of the target user's real-time access request, and access request feedback information is generated to provide an access response, specifically including:

[0034] Acquire real-time access request information, perform data preprocessing on the real-time access request information, perform feature extraction based on the preprocessing result to acquire real-time access request features, and obtain real-time access request feature information;

[0035] Analyze whether the target user's access behavior at the current moment is a registration behavior based on the real-time access request feature information, and if so, obtain the target user's access attribute information to configure user rights;

[0036] Building an access decision model based on RBAC according to the permission configuration database, inputting the target user's access attribute information into the access decision model, extracting the target user's access attribute characteristics and traversing the permission configuration database to obtain mapping rules that match the target user's attribute characteristics for permission allocation;

[0037] If the target user's access behavior at the current moment is not a registration behavior, then obtain the target user's attribute database and extract the target user's access behavior attribute characteristics, user type attribute characteristics and access environment attribute characteristics stored in the database, and input them into the access decision model for authentication analysis to obtain authentication analysis result information;

[0038] The target user's real-time access request is responded to according to the authentication analysis result information to generate access request feedback information.

[0039] In this solution, the input is input into the access decision model for authentication analysis to obtain authentication analysis result information, and further includes:

[0040] Based on the permission configuration database, the permission type configuration table of the target user is obtained according to the user type attribute characteristics, and the available permissions of the current user type attribute are analyzed to obtain first analysis information;

[0041] Analyze the user's access behavior by using the access behavior attribute characteristics to determine whether it is a query behavior or a control behavior, and determine whether the current user has the corresponding authority in combination with the first analysis information. If so, perform authority usage identification;

[0042] The target user's historical access environment feature sequence is constructed using the access environment attribute features, a window attenuation function is set and a sliding window mechanism is constructed to extract the feature sequence, and the initial environment feature sequence is obtained;

[0043] Obtain the trust value of the last target user's request for current permission use, and compare it with a preset threshold. If it is less than the preset threshold, perform window attenuation on the initial environment feature sequence based on a window attenuation function to obtain a final environment feature sequence;

[0044] The real-time access environment information of the target user is obtained, and the real-time trust calculation is performed in combination with the final environment feature sequence to obtain the real-time trust value. According to the real-time trust value, it is determined whether the target user can use the current request permission, and the authentication analysis result information is obtained.

[0045] In this solution, the risk perception mechanism is set up, risk monitoring of user access behavior is performed based on the risk perception mechanism, and user trust is adjusted according to the risk monitoring results, specifically including:

[0046] Monitor user access behavior to obtain access monitoring information, perform time series processing on the access monitoring information and generate a user access sequence, build an anomaly detection model based on an isolation forest algorithm, and input the user access sequence for anomaly detection;

[0047] The RANSAC algorithm is introduced to randomly select a number of sample data according to the input user access sequence, perform linear fitting through the selected sample data, and calculate the difference between the actual observed value and the fitted predicted value based on the linear fitting to generate residual features;

[0048] Extract features from user access sequences, build a new feature matrix based on residual features, determine the total number of trees in the isolated forest and build a feature space based on the new feature matrix;

[0049] Construct a random binary search tree to detect low-density and isolated data points in the feature space, which are defined as isolated points. Calculate the path length of each isolated point in the corresponding tree, compare it with the preset threshold, and obtain anomaly detection information.

[0050] The historical abnormal access features are extracted according to the abnormal detection information to perform risk assessment, and based on the risk assessment result, it is determined whether there is an access risk and the user trust is adjusted.

[0051] A second aspect of the present invention provides a financial data access permission management system, the system comprising: a memory, a processor, the memory containing a financial data access permission management method program, the financial data access permission management method program when executed by the processor to implement the following steps:

[0052] Obtain financial data evaluation instances based on data retrieval, and construct attribute level evaluation rules based on business attributes, access attributes, and sensitive attributes;

[0053] Acquire a financial database, extract financial data attribute features corresponding to each financial data in the financial database and classify the financial data, evaluate the importance of each financial data in combination with an attribute level evaluation rule, and obtain financial data importance evaluation information;

[0054] Reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database;

[0055] Obtain real-time access request information, perform access behavior analysis on the target user's real-time access request, and generate access request feedback information for access response;

[0056] Set up a risk perception mechanism, monitor user access behavior based on the risk perception mechanism, and adjust user trust according to the risk monitoring results.

[0057] The present invention discloses a method and system for managing access rights of financial data, including: obtaining financial data evaluation instances, constructing attribute level evaluation rules with business attributes, access attributes and sensitive attributes as categories; obtaining financial data attribute features corresponding to each financial data and classifying the financial data, and evaluating the importance of each financial data in combination with the attribute level evaluation rules; reclassifying the financial data in the financial database based on the importance evaluation results, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database; constructing an access decision model to analyze access behavior of real-time access requests, generating access request feedback information for access response; setting a risk perception mechanism, performing risk monitoring on user access behavior based on the risk perception mechanism, and adjusting user trust at the same time. The flexibility of authority relations and dynamic adjustment capabilities are improved to ensure the security of authority access. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments or exemplary embodiments of the present invention, the drawings required for use in the embodiments or exemplary descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained according to the drawings without paying creative work.

[0059] Figure 1 A flow chart of a method for managing access rights to financial data provided by one embodiment of the present invention;

[0060] Figure 2 A flow chart of a method for controlling user access rights to financial data provided by an embodiment of the present invention;

[0061] Figure 3A block diagram of a financial data access rights management system provided by one embodiment of the present invention;

[0062] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0063] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0064] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0065] Figure 1 A flow chart of a method for managing access rights to financial data provided by one embodiment of the present invention;

[0066] like Figure 1 As shown, the present invention provides a flow chart of a method for managing access rights to financial data, including:

[0067] S102, obtaining a financial data evaluation instance based on data retrieval, and constructing an attribute level evaluation rule with business attributes, access attributes, and sensitive attributes as categories;

[0068] S104, obtaining a financial database, extracting financial data attribute features corresponding to each financial data in the financial database and classifying the financial data, evaluating the importance of each financial data in combination with an attribute level evaluation rule, and obtaining financial data importance evaluation information;

[0069] S106, reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification result, and generating an authority configuration database;

[0070] S108, obtaining real-time access request information, building an access decision model to analyze the access behavior of the target user's real-time access request, and generating access request feedback information for access response;

[0071] S110, setting a risk perception mechanism, performing risk monitoring on user access behavior based on the risk perception mechanism, and adjusting user trust according to the risk monitoring results.

[0072] It should be noted that the present invention provides a method and system for managing access rights to financial data. First, based on historical data retrieval, a financial data evaluation instance is obtained. Business attribute features, access attribute features and sensitive attribute features are used as categories. The scores corresponding to each attribute feature category in the financial data evaluation instance are extracted respectively. Then, the grade evaluation rules of the three attribute categories are further constructed in combination with the corresponding evaluation parameters, and the importance of financial data is defined from three aspects. Then, the importance of each financial data in the financial database is evaluated based on the constructed grade evaluation rules, and the categories are further divided according to the evaluation results, so as to obtain four sets of financial data of different importance levels, each of which contains financial data of corresponding importance levels. Next, permissions are set and permission roles are constructed based on the importance level of the financial data. At the same time, access rights attributes and access control permission attributes are set to form attribute-role-permission mapping rules to generate a permission configuration database. Subsequently, an access decision model is constructed based on RABC, and real-time access request behavior is analyzed. It is determined whether to provide feedback on access requirements based on the access request behavior. Finally, a risk perception mechanism is set, and user trust is used as a measure of permission use. By perceiving abnormal behavior and risks, the user trust of the corresponding user is further adjusted to ensure data security.

[0073] Furthermore, in a preferred embodiment of the present invention, the financial data evaluation instance is obtained based on data retrieval, and attribute level evaluation rules are constructed with business attributes, access attributes and sensitive attributes as categories, specifically including:

[0074] Obtain financial data evaluation instances based on data retrieval, perform feature extraction on each financial data evaluation instance, and obtain evaluation indicators of business attributes, access attributes, and sensitive attributes of each financial data evaluation instance;

[0075] According to the extracted evaluation indicators, three types of evaluation indicator data sets are formed, namely, business attribute evaluation indicator data set, access attribute evaluation indicator data set and sensitive attribute evaluation indicator data set;

[0076] The usage frequency of each evaluation indicator in the evaluation indicator data set of different categories is counted and sorted, and a business attribute evaluation indicator sorting table, an access attribute evaluation indicator sorting table, and a sensitive attribute evaluation indicator sorting table are generated. The evaluation indicators of each attribute feature are screened to obtain the attribute feature evaluation indicator information;

[0077] Obtaining evaluation results corresponding to business attribute features, access attribute features, and sensitive attribute features in each financial data evaluation instance, and extracting evaluation parameters of each evaluation index based on the attribute feature evaluation index information and associating them with the evaluation results of each attribute feature;

[0078] The associated results based on the evaluation results, evaluation indicators and evaluation parameters respectively constitute the attribute level evaluation rules of business attribute characteristics, access attribute characteristics and sensitive attribute characteristics.

[0079] It should be noted that for the permission setting of the financial system, the importance of the financial data accessed by various permissions is closely related to the permissions, and the importance of financial data can be evaluated from three aspects, namely business attributes, access attributes and sensitive attributes. Sensitive attributes are the sensitivity level of financial data, such as personal information, account balances, transaction details, etc. Access attributes are the access frequency, access address and access time of data. Business attributes refer to the degree of influence of the data on financial business. The higher the business impact, the greater the loss that may be caused by data leakage or abnormal conditions. Therefore, the corresponding historical financial data evaluation instance is obtained through data retrieval. Starting from the evaluation results of each financial data evaluation instance, if the evaluation result of a certain financial data is important, then the evaluation level of the corresponding business attribute, access attribute and sensitive attribute is also important. Then, according to the evaluation indicators and corresponding evaluation parameters used when evaluating each attribute, the level evaluation rules of each attribute are further set. At the same time, based on the frequency of use of the evaluation indicator, the evaluation indicator with a large number of uses is selected to make the final attribute evaluation rule representative. Finally, the attribute level evaluation rules that constitute the business attribute characteristics, access attribute characteristics and sensitive attribute characteristics are formed to provide a basis for subsequent analysis.

[0080] Furthermore, in a preferred embodiment of the present invention, the step of acquiring a financial database, extracting financial data attribute features corresponding to each financial data in the financial database and classifying the financial data, and evaluating the importance of each financial data in combination with an attribute level evaluation rule specifically includes:

[0081] Acquire a financial database, extract financial data attribute characteristics corresponding to each financial data in the financial database, including business attribute characteristics, access attribute characteristics and sensitive attribute characteristics, and obtain financial data attribute characteristic information;

[0082] Generate an attribute feature matrix corresponding to each financial data according to the attribute feature information of the financial data, and calculate the Euclidean distance between the attribute feature matrices of each financial data;

[0083] Introducing the K-means clustering algorithm, presetting the number of cluster centers, and classifying the financial data in the financial database according to the Euclidean distance value between the attribute feature matrices of each financial data;

[0084] Perform multiple iterations of aggregation until all financial data are divided, output several financial data sets, extract features from each financial data set, and obtain the attribute feature matrix of each financial data set;

[0085] Generate corresponding financial data category representations according to the attribute feature matrix of each financial data set, wherein the financial data category representations are composed of business attribute features, access attribute features and sensitive attribute features of the corresponding data set, and obtain financial data classification information;

[0086] Based on the financial data classification information, the attribute level of each financial data set is evaluated using the constructed attribute level evaluation rules, including the business attribute level, the access attribute level and the sensitive attribute level;

[0087] Perform weighted average calculation on the evaluation results of each attribute level of each financial data set, obtain the data importance of the corresponding financial data set according to the calculation results, and obtain the financial data importance evaluation information;

[0088] The financial data importance evaluation information includes four importance evaluation levels, namely extremely important, important, medium and ordinary.

[0089] It should be noted that after constructing the attribute level evaluation rules, the current financial database is obtained, and the importance of the financial data in the database is evaluated by the attribute level evaluation rules. First, the business attribute characteristics, access attribute characteristics and sensitive attribute characteristics of each financial data are extracted to obtain the attribute characteristic information of each financial data. Then, the Euclidean distance value between each financial data is calculated based on the Euclidean distance algorithm, and the K-means clustering algorithm is used to divide the categories, and several financial data sets are output. Next, the attribute feature matrix of each financial data set is obtained, and the weighted average method can be used to obtain the attribute average characteristics of all financial data in the financial data set, so as to obtain the category representation of the financial data set, that is, the feature representation of the business attribute characteristics, access attribute characteristics and sensitive attribute characteristics in the financial data set. Subsequently, the attribute level of each financial data set is evaluated based on the constructed attribute level evaluation rules. The evaluation content includes the business attribute level, access attribute level and sensitive attribute level, and the score of each data set in different dimensions is evaluated in detail. After obtaining the attribute level evaluation results, the weighted average calculation is performed on the attribute levels of each financial data set to obtain the importance of each data set and generate the importance evaluation information of the financial data. The evaluation information divides the importance of financial data into four levels, namely extremely important, important, medium and ordinary. Among them, several financial data sets represent several financial data categories, and the importance evaluation results obtained by evaluating the financial data category representation represent the importance evaluation of each financial data in the corresponding financial data set, so as to more easily and accurately obtain the importance of each financial data in the financial database. In addition, when updating or adding new financial data in subsequent work, it is only necessary to analyze the newly added financial data category to quickly obtain the importance of the newly added data, thereby improving the convenience of financial data management.

[0090] Furthermore, in a preferred embodiment of the present invention, the financial data in the financial database is reclassified based on the financial data importance evaluation information, and authority allocation, role setting and attribute association are performed according to the reclassification results to generate an authority configuration database, which specifically includes:

[0091] Acquire financial data importance evaluation information, and acquire importance evaluation features of each financial data in the financial database according to the financial data importance evaluation information to obtain first analysis information;

[0092] Based on the first analysis information, the importance evaluation feature of the financial data is used as a classification basis to reclassify the financial data in the financial database to obtain reclassification result information;

[0093] Constructing independent permissions corresponding to financial data of different importance levels according to the reclassification result information, and combining permissions based on the constructed independent permissions to obtain combined permissions, and combining the combined permissions and the independent permissions to form a permission set;

[0094] Generate a permission role set according to the permission set, the permission role set including: first-level permission role, second-level permission role, third-level permission role and fourth-level permission role;

[0095] Preset access permission attributes and access control permission attributes, perform permission role attribute allocation in combination with the permission role set, and generate an access permission role attribute set and an access control permission role attribute set;

[0096] A mapping rule between attributes, roles and permissions is established according to the access permission role attribute set and the access control permission role attribute set, and a permission configuration database is generated.

[0097] It should be noted that after evaluating the importance of financial data, the authority is set based on the evaluation results, and four independent authorities are set according to four important levels, and each independent authority corresponds to financial data of an important level. Then, based on the set four independent authorities, a combination is performed to obtain a number of combined authorities, and the combined authorities represent the authorities that can access and control multiple important levels. Then, a permission set is generated by combining independent authorities and combined authorities. Then, four levels of authority roles are generated according to the permission set, and the first-level authority role represents the access control authority of data of one important level, the second-level authority role represents the access control authority of data of two important levels, the third-level authority role represents the access control authority of data of three important levels, and the fourth-level authority role represents the access control authority of data of four important levels. Then, based on the set authority role, the authority attributes of the authority roles of each level are assigned, including the access authority attributes and the access control authority attributes, thereby forming two types of authority roles, and obtaining the access authority role attribute set and the access control authority role attribute set. Finally, based on the access authority role attribute set and the access control authority role attribute set, a mapping rule between attribute-role-authority is established, that is, the authority of the role is judged based on the attribute, thereby constructing a permission configuration database.

[0098] Further, in a preferred embodiment of the present invention, the acquisition of real-time access request information, the construction of an access decision model to analyze the access behavior of the target user's real-time access request, and the generation of access request feedback information to provide an access response specifically include:

[0099] Acquire real-time access request information, perform data preprocessing on the real-time access request information, perform feature extraction based on the preprocessing result to acquire real-time access request features, and obtain real-time access request feature information;

[0100] Analyze whether the target user's access behavior at the current moment is a registration behavior based on the real-time access request feature information, and if so, obtain the target user's access attribute information to configure user rights;

[0101] Building an access decision model based on RBAC according to the permission configuration database, inputting the target user's access attribute information into the access decision model, extracting the target user's access attribute characteristics and traversing the permission configuration database to obtain mapping rules that match the target user's attribute characteristics for permission allocation;

[0102] If the target user's access behavior at the current moment is not a registration behavior, then obtain the target user's attribute database and extract the target user's access behavior attribute characteristics, user type attribute characteristics and access environment attribute characteristics stored in the database, and input them into the access decision model for authentication analysis to obtain authentication analysis result information;

[0103] The target user's real-time access request is responded to according to the authentication analysis result information to generate access request feedback information.

[0104] It should be noted that after the permission configuration database is built, an access decision model is built based on RABC, and permission decisions are made for real-time access requests through the access decision model. Access requests are divided into registration requests and other requests, and the real-time access request features of the real-time access request information are extracted to determine whether it is a registration request. If it is a registration request, the access attribute information of the target user is directly obtained to determine whether it carries special permission configuration identification features, and then the permission configuration database is traversed to obtain the mapping rules that match the attribute features of the target user for permission allocation. If the access behavior of the target user at the current moment is not a registration behavior, an authentication analysis is performed to determine whether the currently requested access rights can be used. Feedback information is generated based on the authentication results to complete the access interaction.

[0105] Furthermore, in a preferred embodiment of the present invention, the input is input into the access decision model for authentication analysis to obtain authentication analysis result information, and further includes:

[0106] Based on the permission configuration database, the permission type configuration table of the target user is obtained according to the user type attribute characteristics, and the available permissions of the current user type attribute are analyzed to obtain first analysis information;

[0107] Analyze the user's access behavior by using the access behavior attribute characteristics to determine whether it is a query behavior or a control behavior, and determine whether the current user has the corresponding authority in combination with the first analysis information. If so, perform authority usage identification;

[0108] The target user's historical access environment feature sequence is constructed using the access environment attribute features, a window attenuation function is set and a sliding window mechanism is constructed to extract the feature sequence, and the initial environment feature sequence is obtained;

[0109] Obtain the trust value of the last target user's request for current permission use, and compare it with a preset threshold. If it is less than the preset threshold, perform window attenuation on the initial environment feature sequence based on a window attenuation function to obtain a final environment feature sequence;

[0110] The real-time access environment information of the target user is obtained, and the real-time trust calculation is performed in combination with the final environment feature sequence to obtain the real-time trust value. According to the real-time trust value, it is determined whether the target user can use the current request permission, and the authentication analysis result information is obtained.

[0111] It should be noted that for access requests that are not registration behaviors, the required permissions for the access behavior of the access request are further analyzed. If they are not available, access denial feedback is generated. If the corresponding permissions are available, it is necessary to further identify whether the corresponding permissions can be used. Dynamic permission management is implemented based on user trust. Before access permission feedback is performed, it is determined whether the access behavior can be fed back normally. The security of the access behavior is further determined by analyzing the access environment attributes of the target user, and the access environment attributes include user identity information, enhanced authentication information, access address, access device type, etc. The access environment attribute characteristics are used to form the historical access environment feature sequence of the target user, and a window attenuation function is set and a sliding window mechanism is constructed to extract the feature sequence, and the user's real-time trust is calculated. The access environment feature sequence within a period of time is extracted by setting a sliding window mechanism, and the window attenuation function is set to control and change the length of the access environment feature sequence, avoiding a fixed access environment feature sequence length, so that attackers or abnormal personnel can affect the use and access of permissions by accumulating trust values ​​for a long time, thereby adapting to changes in user access behavior. When abnormal behavior occurs, the impact of old access environment features on real-time trust is reduced, and then more stringent management permissions are implemented to ensure data security.

[0112] Furthermore, in a preferred embodiment of the present invention, the risk perception mechanism is set, risk monitoring of user access behavior is performed based on the risk perception mechanism, and user trust is adjusted according to the risk monitoring result, specifically including:

[0113] Monitor user access behavior to obtain access monitoring information, perform time series processing on the access monitoring information and generate a user access sequence, build an anomaly detection model based on an isolation forest algorithm, and input the user access sequence for anomaly detection;

[0114] The RANSAC algorithm is introduced to randomly select a number of sample data according to the input user access sequence, perform linear fitting through the selected sample data, and calculate the difference between the actual observed value and the fitted predicted value based on the linear fitting to generate residual features;

[0115] Extract features from user access sequences, build a new feature matrix based on residual features, determine the total number of trees in the isolated forest and build a feature space based on the new feature matrix;

[0116] Construct a random binary search tree to detect low-density and isolated data points in the feature space, which are defined as isolated points. Calculate the path length of each isolated point in the corresponding tree, compare it with the preset threshold, and obtain anomaly detection information.

[0117] The historical abnormal access features are extracted according to the abnormal detection information to perform risk assessment, and based on the risk assessment result, it is determined whether there is an access risk and the user trust is adjusted.

[0118] It should be noted that in the process of normal feedback management of financial data access rights, it is necessary to monitor real-time access behavior to avoid risks. By setting a risk perception mechanism, risk detection is performed on user access behavior, and access monitoring information is processed in time series to generate user access sequences. The anomaly detection model is constructed using the isolation forest algorithm. By analyzing the input user historical access sequence, abnormal data points that are significantly different from normal access behaviors are identified. In this process, the user access sequence is used as input and combined with the RANSAC algorithm to further improve the detection accuracy. By randomly selecting a number of sample data from the user historical access sequence for linear fitting, the difference between the actual observed value and the fitted predicted value is obtained to generate residual features. The residual feature reflects the degree of deviation of the data and is crucial for detecting abnormal behavior. The feature extraction of the user historical access sequence is combined with the residual feature to form a new feature matrix. A random binary search tree is used to detect data points with low distribution density or isolation. In this way, it is determined whether there is abnormal access behavior and anomaly detection information is generated. Based on the anomaly detection information, historical abnormal access features are further extracted to conduct a comprehensive risk assessment to determine whether the current access is risky. If the evaluation results show that there is a high access risk, the user's trust level will be adjusted. The user's trust level is related to whether the corresponding permissions can be used normally, thereby ensuring the security of data and systems.

[0119] Figure 2 A flow chart of a method for controlling user access rights to financial data provided by an embodiment of the present invention;

[0120] like Figure 2 As shown, the present invention provides a flow chart of a method for controlling user access rights of financial data, including:

[0121] S202, obtaining real-time access request information, extracting real-time access request features, analyzing whether the target user's access behavior at the current moment is a registration behavior, and if so, performing user authority configuration;

[0122] S204, if the target user's access behavior at the current moment is not a registration behavior, extract the target user's access behavior attribute characteristics, user type attribute characteristics and access environment attribute characteristics, and perform authentication analysis;

[0123] S206, obtaining a permission type configuration table of the target user according to the user type attribute characteristics based on the permission configuration database, analyzing the available permissions of the current user type attributes, and determining whether the current user has the corresponding permissions;

[0124] S208, if the target user does not have the required access rights, a permission access denial feedback is given; if the target user has the required access rights, a historical access environment feature sequence of the target user is constructed using the access environment attribute features, and a feature sequence is extracted through a sliding window mechanism to obtain a final environment feature sequence;

[0125] S210, based on the real-time access environment information of the target user, the real-time trust value is calculated in combination with the final environment feature sequence, and it is determined whether the target user can use the current requested permission, and access request feedback information is generated;

[0126] S212, monitor the user's access behavior to obtain access monitoring information, use an anomaly detection model to detect abnormal access behavior, and perform risk assessment, and change the user's trust according to the risk assessment results.

[0127] It should be noted that by setting up a risk perception mechanism and a sliding window mechanism to manage permission access based on user trust, attackers or abnormal personnel can be prevented from influencing the use and access of permissions by accumulating trust values ​​over a long period of time, thereby adapting to changes in user access behavior. When abnormal behavior occurs, the impact of old access behavior on real-time trust is reduced, thereby more strictly managing permissions and ensuring data security.

[0128] Figure 3 A financial data access permission management system 3 is provided in one embodiment of the present invention. The system includes: a memory 31 and a processor 32. The memory 31 includes a financial data access permission management method program. When the financial data access permission management method program is executed by the processor 32, the following steps are implemented:

[0129] Obtain financial data evaluation instances based on data retrieval, and construct attribute level evaluation rules based on business attributes, access attributes, and sensitive attributes;

[0130] Acquire a financial database, extract financial data attribute features corresponding to each financial data in the financial database and classify the financial data, evaluate the importance of each financial data in combination with an attribute level evaluation rule, and obtain financial data importance evaluation information;

[0131] Reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database;

[0132] Obtain real-time access request information, perform access behavior analysis on the target user's real-time access request, and generate access request feedback information for access response;

[0133] Set up a risk perception mechanism, monitor user access behavior based on the risk perception mechanism, and adjust user trust according to the risk monitoring results.

[0134] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0135] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0136] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0137] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0138] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0139] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for managing access rights to financial data, characterized in that: include: Obtain financial data evaluation instances based on data retrieval, and construct attribute level evaluation rules based on business attributes, access attributes, and sensitive attributes; Acquire a financial database, extract financial data attribute features corresponding to each financial data in the financial database and classify the financial data, evaluate the importance of each financial data in combination with an attribute level evaluation rule, and obtain financial data importance evaluation information; Reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database; Obtain real-time access request information, build an access decision model to analyze the access behavior of the target user's real-time access request, and generate access request feedback information for access response; Set up a risk perception mechanism, monitor user access behaviors based on the risk perception mechanism, and adjust user trust according to the risk monitoring results; The obtaining of real-time access request information, building an access decision model to analyze access behavior of the target user's real-time access request, and generating access request feedback information to provide access response specifically include: Acquire real-time access request information, perform data preprocessing on the real-time access request information, perform feature extraction based on the preprocessing result to acquire real-time access request features, and obtain real-time access request feature information; Analyze whether the target user's access behavior at the current moment is a registration behavior based on the real-time access request feature information, and if so, obtain the target user's access attribute information to configure user rights; Building an access decision model based on RBAC according to the permission configuration database, inputting the target user's access attribute information into the access decision model, extracting the target user's access attribute characteristics and traversing the permission configuration database to obtain mapping rules that match the target user's attribute characteristics for permission allocation; If the target user's access behavior at the current moment is not a registration behavior, then obtain the target user's attribute database and extract the target user's access behavior attribute characteristics, user type attribute characteristics and access environment attribute characteristics stored in the database, and input them into the access decision model for authentication analysis to obtain authentication analysis result information; Respond to the target user's real-time access request based on the authentication analysis result information and generate access request feedback information; The input is input into the access decision model for authentication analysis to obtain authentication analysis result information, including: Based on the permission configuration database, the permission type configuration table of the target user is obtained according to the user type attribute characteristics, and the available permissions of the current user type attribute are analyzed to obtain first analysis information; Analyze the user's access behavior by using the access behavior attribute characteristics to determine whether it is a query behavior or a control behavior, and determine whether the current user has the corresponding authority in combination with the first analysis information. If so, perform authority usage identification; The target user's historical access environment feature sequence is constructed using the access environment attribute features, a window attenuation function is set and a sliding window mechanism is constructed to extract the feature sequence, and the initial environment feature sequence is obtained; Obtain the trust value of the last target user's request for current permission use, and compare it with a preset threshold. If it is less than the preset threshold, perform window attenuation on the initial environment feature sequence based on a window attenuation function to obtain a final environment feature sequence; The real-time access environment information of the target user is obtained, and the real-time trust calculation is performed in combination with the final environment feature sequence to obtain the real-time trust value. According to the real-time trust value, it is determined whether the target user can use the current request permission, and the authentication analysis result information is obtained.

2. A method for managing access rights to financial data according to claim 1, characterized in that: The method of obtaining a financial data evaluation instance based on data retrieval and constructing an attribute level evaluation rule with business attributes, access attributes and sensitive attributes as categories specifically includes: Obtain financial data evaluation instances based on data retrieval, perform feature extraction on each financial data evaluation instance, and obtain evaluation indicators of business attributes, access attributes, and sensitive attributes of each financial data evaluation instance; According to the extracted evaluation indicators, three types of evaluation indicator data sets are formed, namely, business attribute evaluation indicator data set, access attribute evaluation indicator data set and sensitive attribute evaluation indicator data set; The usage frequency of each evaluation indicator in the evaluation indicator data set of different categories is counted and sorted, and a business attribute evaluation indicator sorting table, an access attribute evaluation indicator sorting table, and a sensitive attribute evaluation indicator sorting table are generated. The evaluation indicators of each attribute feature are screened to obtain the attribute feature evaluation indicator information; Obtaining evaluation results corresponding to business attribute features, access attribute features, and sensitive attribute features in each financial data evaluation instance, and extracting evaluation parameters of each evaluation index based on the attribute feature evaluation index information and associating them with the evaluation results of each attribute feature; The associated results based on the evaluation results, evaluation indicators and evaluation parameters respectively constitute the attribute level evaluation rules of business attribute characteristics, access attribute characteristics and sensitive attribute characteristics.

3. A method for managing access rights to financial data according to claim 1, characterized in that: The step of obtaining a financial database, extracting the financial data attribute characteristics corresponding to each financial data in the financial database and classifying the financial data, and evaluating the importance of each financial data in combination with the attribute level evaluation rule specifically includes: Acquire a financial database, extract financial data attribute characteristics corresponding to each financial data in the financial database, including business attribute characteristics, access attribute characteristics and sensitive attribute characteristics, and obtain financial data attribute characteristic information; Generate an attribute feature matrix corresponding to each financial data according to the attribute feature information of the financial data, and calculate the Euclidean distance between the attribute feature matrices of each financial data; Introducing the K-means clustering algorithm, presetting the number of cluster centers, and classifying the financial data in the financial database according to the Euclidean distance value between the attribute feature matrices of each financial data; Perform multiple iterations of aggregation until all financial data are divided, output several financial data sets, extract features from each financial data set, and obtain the attribute feature matrix of each financial data set; Generate corresponding financial data category representations according to the attribute feature matrix of each financial data set, wherein the financial data category representations are composed of business attribute features, access attribute features and sensitive attribute features of the corresponding data set, and obtain financial data classification information; Based on the financial data classification information, the attribute level of each financial data set is evaluated using the constructed attribute level evaluation rules, including the business attribute level, the access attribute level and the sensitive attribute level; Perform weighted average calculation on the evaluation results of each attribute level of each financial data set, obtain the data importance of the corresponding financial data set according to the calculation results, and obtain the financial data importance evaluation information; The financial data importance evaluation information includes four importance evaluation levels, namely extremely important, important, medium and ordinary.

4. A method for managing access rights to financial data according to claim 1, characterized in that: The reclassifying of the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification result, and generating an authority configuration database specifically includes: Acquire financial data importance evaluation information, and acquire importance evaluation features of each financial data in the financial database according to the financial data importance evaluation information to obtain first analysis information; Based on the first analysis information, the importance evaluation feature of the financial data is used as a classification basis to reclassify the financial data in the financial database to obtain reclassification result information; Constructing independent permissions corresponding to financial data of different importance levels according to the reclassification result information, and combining permissions based on the constructed independent permissions to obtain combined permissions, and combining the combined permissions and the independent permissions to form a permission set; Generate a permission role set according to the permission set, the permission role set including: first-level permission role, second-level permission role, third-level permission role and fourth-level permission role; Preset access permission attributes and access control permission attributes, perform permission role attribute allocation in combination with the permission role set, and generate an access permission role attribute set and an access control permission role attribute set; A mapping rule between attributes, roles and permissions is established according to the access permission role attribute set and the access control permission role attribute set, and a permission configuration database is generated.

5. A method for managing access rights to financial data according to claim 1, characterized in that: The risk perception mechanism is set up, risk monitoring of user access behavior is performed based on the risk perception mechanism, and user trust is adjusted according to the risk monitoring results, specifically including: Monitor user access behavior to obtain access monitoring information, perform time series processing on the access monitoring information and generate a user access sequence, build an anomaly detection model based on an isolation forest algorithm, and input the user access sequence for anomaly detection; The RANSAC algorithm is introduced to randomly select a number of sample data according to the input user access sequence, perform linear fitting through the selected sample data, and calculate the difference between the actual observed value and the fitted predicted value based on the linear fitting to generate residual features; Extract features from user access sequences, build a new feature matrix based on residual features, determine the total number of trees in the isolated forest and build a feature space based on the new feature matrix; Construct a random binary search tree to detect low-density and isolated data points in the feature space, which are defined as isolated points. Calculate the path length of each isolated point in the corresponding tree, compare it with the preset threshold, and obtain anomaly detection information. The historical abnormal access features are extracted according to the abnormal detection information to perform risk assessment, and based on the risk assessment result, it is determined whether there is an access risk and the user trust is adjusted.

6. A financial data access rights management system, characterized in that: The system includes: a memory and a processor, wherein the memory includes a financial data access permission management method program, and when the financial data access permission management method program is executed by the processor, the following steps are implemented: Obtain financial data evaluation instances based on data retrieval, and construct attribute level evaluation rules based on business attributes, access attributes, and sensitive attributes; Acquire a financial database, extract financial data attribute features corresponding to each financial data in the financial database and classify the financial data, evaluate the importance of each financial data in combination with an attribute level evaluation rule, and obtain financial data importance evaluation information; Reclassifying the financial data in the financial database based on the financial data importance evaluation information, performing authority allocation, role setting and attribute association according to the reclassification results, and generating an authority configuration database; Obtain real-time access request information, build an access decision model to analyze the access behavior of the target user's real-time access request, and generate access request feedback information for access response; Set up a risk perception mechanism, monitor user access behaviors based on the risk perception mechanism, and adjust user trust according to the risk monitoring results; The obtaining of real-time access request information, building an access decision model to analyze access behavior of the target user's real-time access request, and generating access request feedback information to provide access response specifically include: Acquire real-time access request information, perform data preprocessing on the real-time access request information, perform feature extraction based on the preprocessing result to acquire real-time access request features, and obtain real-time access request feature information; Analyze whether the target user's access behavior at the current moment is a registration behavior based on the real-time access request feature information, and if so, obtain the target user's access attribute information to configure user rights; Building an access decision model based on RBAC according to the permission configuration database, inputting the target user's access attribute information into the access decision model, extracting the target user's access attribute characteristics and traversing the permission configuration database to obtain mapping rules that match the target user's attribute characteristics for permission allocation; If the target user's access behavior at the current moment is not a registration behavior, then obtain the target user's attribute database and extract the target user's access behavior attribute characteristics, user type attribute characteristics and access environment attribute characteristics stored in the database, and input them into the access decision model for authentication analysis to obtain authentication analysis result information; Respond to the target user's real-time access request based on the authentication analysis result information and generate access request feedback information; The input is input into the access decision model for authentication analysis to obtain authentication analysis result information, including: Based on the permission configuration database, the permission type configuration table of the target user is obtained according to the user type attribute characteristics, and the available permissions of the current user type attribute are analyzed to obtain first analysis information; Analyze the user's access behavior by using the access behavior attribute characteristics to determine whether it is a query behavior or a control behavior, and determine whether the current user has the corresponding authority in combination with the first analysis information. If so, perform authority usage identification; The target user's historical access environment feature sequence is constructed using the access environment attribute features, a window attenuation function is set and a sliding window mechanism is constructed to extract the feature sequence, and the initial environment feature sequence is obtained; Obtain the trust value of the last target user's request for current permission use, and compare it with a preset threshold. If it is less than the preset threshold, perform window attenuation on the initial environment feature sequence based on a window attenuation function to obtain a final environment feature sequence; The real-time access environment information of the target user is obtained, and the real-time trust calculation is performed in combination with the final environment feature sequence to obtain the real-time trust value. According to the real-time trust value, it is determined whether the target user can use the current request permission, and the authentication analysis result information is obtained.

Images