Access control method and system for data security protection

Abstract

The present invention discloses an access control method and system for data security protection, which relates to data security related fields. The method includes: obtaining user access request information, performing sensitivity assessment, obtaining access data sensitivity information, matching with a security verification method library, and obtaining a target security verification method; performing multi-dimensional identity authentication on the target user, obtaining a security verification result, and when the result is passed, performing dynamic access permission adjustment to obtain access permission data information; performing access monitoring, obtaining user access behavior information, performing abnormal analysis, and obtaining abnormal access behavior feature information; performing access control analysis, obtaining data security access strategy, and performing access restriction protection. The method solves the technical problems of low security protection effect and data leakage risk in existing data access control, and achieves the technical effect of improving data security protection effect and effectively reducing data leakage and illegal access risks.

Description

Technical Field

[0001] The present application relates to data security related fields, and in particular to an access control method and system for data security protection. Background Art

[0002] With the rapid development of information technology, data has become an important asset for the operation of enterprises and society. However, security issues such as data leakage, tampering and illegal access are frequent, causing huge losses to enterprises and individuals. In order to ensure the security of data, access control mechanism has become a key link in data security protection. In existing data security protection methods, access control usually adopts static role permission management. This method realizes access control to data by pre-setting user roles and corresponding access rights. However, due to the fixed role and permission settings, this method cannot dynamically adapt to the access needs of different users and changes in data sensitivity, and there are great security risks.

[0003] Among the current related technologies, data access control has technical problems such as low security protection effect and risk of data leakage. Summary of the invention

[0004] The present application provides an access control method and system for data security protection, and adopts technical means such as sensitivity assessment, multi-dimensional identity authentication, dynamic access permission adjustment, access monitoring, anomaly analysis, access control analysis, and access restriction protection to achieve dynamic adjustment of access permissions and real-time monitoring of user access behavior, thereby achieving the technical effect of improving data security protection and effectively reducing the risk of data leakage and illegal access.

[0005] This application provides an access control method for data security protection, including:

[0006] S1: obtaining user access request information, performing sensitivity assessment on the user access request information, obtaining access data sensitivity information, matching the access data sensitivity information with a security verification method library, and obtaining a target security verification method;

[0007] S2: Perform multi-dimensional identity authentication on the target user based on the target security authentication method to obtain a security authentication result. When the security authentication result is passed, dynamically adjust the access permission of the target user according to the user access request information to obtain access permission data information;

[0008] S3: monitoring the access to the access permission data information by the target user, obtaining the user access behavior information, performing abnormal analysis on the user access behavior information, and obtaining abnormal access behavior feature information;

[0009] S4: Perform access control analysis on the abnormal access behavior feature information to obtain a data security access policy, and perform access restriction protection on the access permission data information based on the data security access policy.

[0010] In a possible implementation, the access data sensitivity information is obtained in S1, and the following processing is performed:

[0011] S11: Acquire a target access data system, perform access data analysis on the target access data system, and obtain target access data architecture information;

[0012] S12: constructing data description factor information, wherein the data description factor information includes data type, data level, data dimension and source range;

[0013] S13: Based on the data description factor information, feature description is performed on each access data in the target access data architecture information to obtain target access data description feature information;

[0014] S14: constructing a data sensitivity discriminator according to the target access data description feature information, and performing a sensitivity assessment on the user access request information based on the data sensitivity discriminator to obtain the access data sensitivity information.

[0015] In a possible implementation, a data sensitivity discriminator is constructed in S14 to perform the following processing:

[0016] Based on the target access data description feature information, the data description factor information is identified for content discrimination to obtain a data description factor identification content node set;

[0017] According to the data management standard, the data description factor information is divided into sensitivity levels, and the sensitivity division rules of the data description factors are defined;

[0018] Based on the data description factor sensitivity classification rule, the data description factor discrimination content node set is subjected to sensitivity identification to obtain a data content node description factor sensitivity set;

[0019] The sensitivity set of the data content node description factors is subjected to factor weighting calculation to obtain a data content node sensitivity information set, and the data sensitivity discriminator is trained and constructed based on the data description factor discrimination content node set and the data content node sensitivity information set.

[0020] In a possible implementation, the access permission data information is obtained in S2, and the following processing is performed:

[0021] S21: Obtain the role tag information of the target user, and determine the role authority information of the target user based on matching the role tag information with the system role authority library;

[0022] S22: Identify the context of the target user and obtain access context feature information;

[0023] S23: matching the access permission of the access context environment feature information according to the preset environment access rule to obtain the target environment access permission information;

[0024] S24: Content mapping is performed on the intersection of the target user role permission information and the target environment access permission information with the user access request information to obtain the access permission data information.

[0025] In a possible implementation, the access permission data information is obtained in S24, and the following processing is performed:

[0026] According to the data description factor information, each system role in the system role permission library is divided into factor permissions, and a system role factor permission label set is obtained;

[0027] Based on the mapping and matching of the system role factor permission tag set and the target access data architecture information, a system role permission access data content set is obtained;

[0028] Dividing the target access data architecture information into content according to the preset environment access rules to obtain an environment authority access data content set;

[0029] Match and intersect the target user role permission information with the system role permission access data content set, and the target environment permission access information with the environment permission access data content set, to obtain accessible data intersection content information;

[0030] Content mapping is performed based on the accessible data intersection content information and the user access request information to obtain the access permission data information.

[0031] In a possible implementation, the abnormal access behavior feature information is obtained in S3, and the following processing is performed:

[0032] S31: Collect and obtain a system access database, define abnormal behavior recognition rules to annotate the system access database with abnormal features, and obtain a sample set of system access abnormal behavior features;

[0033] S32: performing model convergence training on the system access abnormal behavior feature sample set to construct an abnormal access behavior feature recognition model, wherein the abnormal access behavior feature recognition model includes an abnormal behavior pattern recognition model and an abnormal behavior degree recognition model;

[0034] S33: Performing an abnormal analysis on the user access behavior information based on the abnormal access behavior feature recognition model, and outputting the abnormal access behavior feature information.

[0035] In a possible implementation, the data security access policy is obtained by performing the following processing:

[0036] Acquire a security access policy library, wherein the security access policy library includes historical abnormal access behavior feature data and corresponding security access policies;

[0037] Performing similarity analysis based on the abnormal access behavior feature information and the security access policy library to obtain a security access policy set within a preset similarity threshold;

[0038] A multi-dimensional protection test is performed on the security access policy set to obtain an access policy security protection effect set, and the data security access policy is obtained by screening according to the access policy security protection effect set.

[0039] This application also provides an access control system for data security protection, including:

[0040] A target security verification method acquisition module, the target security verification method acquisition module is used to obtain user access request information, perform sensitivity assessment on the user access request information, obtain access data sensitivity information, and match the access data sensitivity information with a security verification method library to obtain a target security verification method;

[0041] an access permission data information acquisition module, the access permission data information acquisition module is used to perform multi-dimensional identity authentication on the target user based on the target security verification method to obtain a security verification result, and when the security verification result is passed, dynamically adjust the access permission of the target user through the user access request information to obtain the access permission data information;

[0042] An abnormal access behavior characteristic information acquisition module is used to monitor the access to the access permission data information by the target user, obtain the user access behavior information, perform abnormal analysis on the user access behavior information, and obtain abnormal access behavior characteristic information;

[0043] An access restriction protection module is used to perform access control analysis on the abnormal access behavior feature information, obtain a data security access policy, and perform access restriction protection on the accessible data information based on the data security access policy.

[0044] The access control method and system for data security protection proposed in the present application first obtain user access request information, perform sensitivity assessment on the user access request information, obtain access data sensitivity information, match the access data sensitivity information with the security verification method library, and obtain the target security verification method. Then, based on the target security verification method, perform multi-dimensional identity authentication on the target user to obtain a security verification result. When the security verification result is passed, dynamically adjust the access rights of the target user through the user access request information to obtain the accessible data information. Then, monitor the access to the accessible data information through the target user, obtain user access behavior information, perform abnormal analysis on the user access behavior information, and obtain abnormal access behavior feature information. Finally, perform access control analysis on the abnormal access behavior feature information to obtain a data security access policy, and perform access restriction protection on the accessible data information based on the data security access policy, thereby achieving the technical effect of improving data security protection effects and effectively reducing the risks of data leakage and illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0046] Figure 1 A flowchart of an access control method for data security protection provided in an embodiment of the present application;

[0047] Figure 2 A schematic diagram of the structure of an access control system for data security protection provided in an embodiment of the present application.

[0048] Explanation of the reference numerals: target security verification method acquisition module 10 , access permission data information acquisition module 20 , abnormal access behavior characteristic information acquisition module 30 , access restriction protection module 40 . DETAILED DESCRIPTION

[0049] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0050] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0051] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0052] The present application provides an access control method for data security protection, such as Figure 1 As shown, the method includes:

[0053] S1: Obtain user access request information, perform sensitivity assessment on the user access request information, obtain access data sensitivity information, match the access data sensitivity information with the security verification method library, and obtain the target security verification method. Specifically, listen to and capture access requests from users. User access request information is all information contained in the access request initiated by the user to the system, including the requested resources, methods, parameters, etc. Parse the captured user access request information and extract key information, such as the requested resource path, user identifier in the request header, etc. Identify the target resource that the user is trying to access from the user access request information, such as a specific database table, file or API interface, and perform sensitivity assessment on the target resource according to the preset resource sensitivity rules or models, including analysis of the confidentiality, integrity, availability and other attributes of the resource. According to the evaluation results, assign a sensitivity level to the user's access request, such as "high sensitivity", "medium sensitivity" or "low sensitivity". A security verification method library is defined in advance. The security verification method library is a database or configuration file containing various security verification methods and their corresponding sensitivity level requirements, which includes various security verification methods (such as password verification, biometric recognition, dynamic tokens, etc.) and their corresponding sensitivity level requirements. According to the access data sensitivity information, by comparing the access data sensitivity information with the sensitivity level requirements defined in the security verification method library, a matching security verification method is searched in the security verification method library, and one or more security verification methods are selected from the matching results as the target security verification method to verify the user's identity and authorization.

[0054] In a possible implementation, the access data sensitivity information is obtained in S1, further including S11: obtaining the target access data system, parsing the access data of the target access data system, and obtaining the target access data architecture information. Specifically, the target access data system that the user wants to access is clarified. The target access data system is a data storage system that the user wants to access, which contains data that needs to be accessed and managed. It can be a database, API interface or file system, etc. Parse the data structure, data relationship, etc. in the target access data system to determine the data architecture, table structure, field type, etc. of the target access data system. Extract the target access data architecture information from the parsing results. The target access data architecture information is the data structure, data relationship, etc. information obtained by parsing the target access data system, such as data table name, field name, data type, etc. S12: Construct data description factor information, and the data description factor information includes data type, data level, data dimension and source range. Specifically, the data description factor information is a set of information used to describe the attributes of data, which is used to help understand and analyze the characteristics of data, wherein the data type is the type or category of data, such as text, numerical value, date, etc., and the data type determines the storage and processing methods of data; the data level is the position or level of data in the organizational structure, such as company level, department level, individual level, etc., reflecting the importance and scope of influence of data; the data dimension describes the different aspects or attributes of data characteristics, which is used to analyze and interpret data from multiple angles, such as user identity, transaction amount, geographic location, etc. in commercial data; the source range refers to the source or origin of data, such as internal system, external partner, public data source, etc., which is used to evaluate the credibility and reliability of data. S13: Based on the data description factor information, the access data in the target access data architecture information is characterized and the target access data description characteristic information is obtained. Specifically, each data item in the target access data architecture information is matched with the data description factor information, and according to the matching result, the characteristic information such as the data type, data level, data dimension, etc. of each data item is extracted, and the extracted characteristic information is integrated to form the target access data description characteristic information. S14: constructing a data sensitivity discriminator according to the target access data description feature information, and performing a sensitivity assessment on the user access request information based on the data sensitivity discriminator to obtain the access data sensitivity information.Specifically, according to the characteristic information describing the target access data, a discriminator capable of identifying the sensitivity of the data is constructed. The data sensitivity discriminator can be an algorithm model or a set of rules used to judge the sensitivity of the data according to the characteristics and rules of the data. The user access request information is input into the data sensitivity discriminator, and the data is evaluated for sensitivity according to the logic and rules of the data sensitivity discriminator. The evaluation result, i.e., the access data sensitivity information, is the information about the sensitivity of the data involved in the user access request information, which can be a sensitivity level or score. This implementation method more accurately judges the sensitivity and importance of the data by analyzing the data architecture and characteristics of the target access data system, and achieves the technical effect of refined management and security control of user access requests.

[0055] In a possible implementation, the data sensitivity discriminator constructed in S14 further includes: discriminating content identification of the data description factor information based on the target access data description feature information to obtain a data description factor discrimination content node set. Specifically, extract information related to the data description factor information from the target access data description feature information, and for each data description factor information (data type, data level, data dimension, source range), identify the specific content or sub-items it contains, each sub-item as a discrimination content node, and integrate all identified discrimination content nodes into a set, namely, a data description factor discrimination content node set. According to the data management standard, the data description factor information is respectively divided into sensitivity, and the data description factor sensitivity division rules are defined. Specifically, according to the data management standards of the industry or organization (the specifications and standards formulated by the industry or organization on data management, data security, etc.), the sensitivity division principles of different data description factor information are determined. For each data description factor information, its sensitivity level (such as high, medium, and low) is defined according to standards or actual needs, and a specific sensitivity classification rule is formulated for each data description factor information to clarify how to judge its sensitivity level according to the data content. Based on the data description factor sensitivity classification rule, the data description factor discrimination content node set is subjected to sensitivity identification to obtain a data content node description factor sensitivity set. Specifically, the defined data description factor sensitivity classification rule is applied to the data description factor discrimination content node set, and the sensitivity of each discrimination content node is evaluated according to the data description factor sensitivity classification rule to determine the sensitivity level, and all identified data content node description factor sensitivities are integrated into a set, namely, the data content node description factor sensitivity set. The data content node description factor sensitivity set is subjected to factor weighted calculation to obtain a data content node sensitivity information set, and the data sensitivity discriminator is trained and constructed based on the data description factor discrimination content node set and the data content node sensitivity information set. Specifically, according to actual needs or expert experience, a weight is assigned to each data description factor information or discriminant content node, and a weighted calculation method (such as mean weighting, product weighting, etc.) is used to calculate the comprehensive sensitivity of each data content node based on the data content node description factor sensitivity set and weight, and all calculated data content node sensitivities are integrated into a set, namely, a data content node sensitivity information set. The data description factor discriminant content node set and the data content node sensitivity information set are used as training data to train and construct a data sensitivity discriminator, which can be a machine learning model, a decision tree, a neural network, etc.This implementation method ensures that the data sensitivity discriminator can cover all important data content and dimensions by identifying the content of data description factor information based on the target access data description feature information, and performs sensitivity classification and rule definition in accordance with data management standards, ensuring that the evaluation results of the data sensitivity discriminator meet the standards of the industry or organization. Through factor weighted calculation and model training, the accuracy and generalization ability of the data sensitivity discriminator are further improved, enabling it to cope with complex and changeable data environments and access requests. Finally, an accurate and reliable data sensitivity discriminator is constructed, achieving the technical effect of performing refined sensitivity assessment of user access requests.

[0056] S2: Perform multi-dimensional identity authentication on the target user based on the target security authentication method to obtain a security authentication result. When the security authentication result is passed, dynamically adjust the access rights of the target user through the user access request information to obtain the access rights data information. Specifically, according to the target security authentication method determined in step S1, prepare the corresponding authentication tools, systems or services to perform multi-dimensional identity authentication, that is, use a variety of different authentication methods to verify the identity of the target user to improve the accuracy and security of identity authentication, including static password authentication (requiring the user to enter his static password for authentication), biometric identification (such as fingerprint identification, facial recognition, etc., obtaining the user's biometric information through a biometric collection device and comparing it), dynamic token authentication (such as mobile phone verification code, dynamic password, etc., sending a dynamic token to the user through SMS, APP push, etc., and requiring the user to enter for verification) and other authentication methods (such as device fingerprint, IP address whitelist, etc.). Record the results of each verification step, including verification success or failure, summarize the results of all verification steps, and comprehensively judge whether the identity authentication of the target user is passed based on the summarized verification results. If all verification steps are successful, it is passed, otherwise it is not passed. When the security verification result is passed, the purpose and context of the user's access are analyzed based on the user's access request information (such as the requested resources, request time, and the role of the requester). Based on the user's role, historical behavior, and the sensitivity of the requested resources, the permission adjustment strategy is determined, including granting new permissions, upgrading the level of existing permissions, and restricting certain permissions. According to the determined permission adjustment strategy, the access rights of the target user are dynamically adjusted, such as updating the user permission table and session information. The user's dynamically adjusted access rights information is organized into accessible access rights data information. Access rights data information is the specific access rights information obtained by the target user after identity authentication and permission adjustment, including the user's accessible resource list, permission level, and effective time.

[0057] In a possible implementation, the obtaining of the access rights data information in S2 further includes S21: obtaining the role tag information of the target user, matching the role tag information with the system role permission library, and determining the role permission information of the target user. Specifically, the role tag information (information used to identify the role played by the user in the system) of the target user is obtained from the user authentication information or user data, such as "HR administrator", "project manager", etc., and the corresponding role permission is searched in the pre-defined system role permission library according to the user's role tag information, wherein the system role permission library is a database or configuration file that stores all roles in the system and their corresponding permissions, and contains a set of access rights owned by different roles. The permission information matching the role tag information is extracted from the system role permission library to obtain the target user role permission information, and the target user role permission information defines the data range, operation type, etc. that the target user can access. S22: Identifying the context environment of the target user and obtaining access context environment feature information. Specifically, the context environment data related to the target user's access is collected, and the context environment refers to the environment in which the user performs the access operation, including the physical environment (such as location, time) and the network environment (such as device information, network status), etc. Extract key feature information from the collected context environment data, namely, access context environment feature information. The access context environment feature information describes the attributes and status of the environment and is used to determine whether the target user's access environment meets the preset security requirements. S23: Match the access rights to the access context environment feature information according to the preset environment access rules to obtain the target environment access rights information. Specifically, according to the security policy and actual needs of the organization, a series of environment access rules are preset. The environment access rules are rules or policies used to determine what access rights a user should have in different environments. Match the extracted access context environment feature information with the preset environment access rules to determine the access rights that the target user should have in the current environment. According to the matching results, generate the target environment access rights information. The target environment access rights information describes the data range, operation type, etc. that the target user can access in the current environment. S24: Content-map the intersection of the target user role permission information and the target environment access rights information with the user access request information to obtain the access rights data information. Specifically, an intersection operation is performed on the target user role permission information determined in step S21 and the target environment access permission information determined in step S23 to obtain a permission set that the user can actually access in the current environment. The obtained access permission set is content-mapped with the user access request information, that is, it is checked whether the target user's access request is within the scope of his / her accessible permissions. Based on the result of the content mapping, the final access permission data information is generated. If the user's access request is within the scope of his / her accessible permissions, access is allowed; otherwise, access is denied.This implementation method combines the user's role permission information and contextual environment feature information to accurately determine whether the target user's access request is legal, thereby effectively preventing unauthorized access and data leakage, and achieving the technical effect of flexibly obtaining accessible access data information according to the needs of different users and environments while meeting security requirements.

[0058] In a possible implementation, the access permission data information obtained in S24 further includes: dividing the factor permissions of each system role in the system role permission library according to the data description factor information, and obtaining a system role factor permission label set. Specifically, the data description factor information in the system is analyzed, including data type, data level, data dimension, and source range, and the factor permissions of each system role in the system role permission library are divided according to the data description factor information. For example, each system role is assigned an access level label (such as "read-only", "read-write", etc.) corresponding to the data description factor information. The factor permission division results of each system role are integrated into a set, namely, a system role factor permission label set, and the system role factor permission label set contains the access permission information of each system role under different data description factor information. Based on the mapping and matching of the system role factor permission label set and the target access data architecture information, a system role permission access data content set is obtained. Specifically, based on the system role factor permission label set, mapping and matching are performed with the target access data architecture information (such as database table structure, data field, etc.). Through mapping and matching, the specific data content that each system role can access under the target access data architecture information is determined, and the accessible data content of all system roles is integrated into a set, namely, the system role permission access data content set. The target access data architecture information is content-divided according to the preset environment access rules to obtain the environment permission access data content set. Specifically, according to the preset environment access rules, the target access data architecture information is content-divided. The preset environment access rules define data access permissions in different environments based on the context of the target user. Through content division, the data content that can be accessed in a specific environment is determined, and the data content that can be accessed in all environments is integrated into a set, namely, the environment permission access data content set. The target user role permission information is matched with the system role permission access data content set, and the target environment access permission information is matched with the environment permission access data content set to obtain the accessible data intersection content information. Specifically, match the target user role permission information with the system role permission access data content set, and find the intersection. This intersection represents the data content that the target user can access under the role permission; match the target environment access permission information with the environment permission access data content set, and find the intersection. This intersection represents the data content that the target user can access under a specific environment. The above two intersections are intersected again to obtain the final accessible data intersection content information. The accessible data intersection content information represents the data content that the target user can actually access under the current role and environment. Content mapping is performed based on the accessible data intersection content information and the user access request information to obtain the accessible data permission data information.Specifically, based on the accessible data intersection content information, content mapping is performed with the user access request information to check whether the target user's access request is within the scope of his accessible permissions. Based on the results of the content mapping, the final accessible permissions data information is generated. If the target user's access request is within the scope of his accessible permissions, access is allowed; otherwise, access is denied. This implementation method combines system role permissions and context environment permissions to more accurately control the target user's access rights to data, can adapt to the needs of different users and environments, and achieves the technical effect of ensuring the security and compliance of data access.

[0059] S3: Monitor the access to the access permission data information by the target user, obtain the user access behavior information, perform anomaly analysis on the user access behavior information, and obtain abnormal access behavior feature information. Specifically, after the target user successfully passes the identity authentication and obtains the access permission data information, start the access monitoring mechanism for the target user, and monitor all user access behavior information of the target user in real time. The user access behavior information is all the behavior data generated when the target user accesses the system, including the time of access, the resources accessed, the access method (such as reading, writing, executing, etc.), the frequency of operation, etc., and record this information in the log or database. Collect user access behavior information from the monitoring log or database regularly or in real time, clean, integrate and format the collected data to ensure the accuracy and consistency of the data. According to business needs and security policies, define which user access behaviors are considered abnormal, such as abnormally high access frequency, access during non-working hours, unauthorized access to sensitive resources, etc. Use data analysis tools or machine learning algorithms to establish a user access behavior analysis model. The user access behavior analysis model identifies abnormal behaviors based on statistical methods, rule engines, or machine learning algorithms (such as anomaly detection algorithms). Input user access behavior information into the user access behavior analysis model, perform anomaly analysis, and identify abnormal user access behaviors. Extract abnormal access behavior feature information from the detected abnormal access behavior, that is, key features or attribute key feature information that describes the abnormal access behavior, such as the type of abnormal behavior, the time of occurrence, and the resources involved.

[0060] In a possible implementation, the abnormal access behavior feature information obtained in S3 further includes S31: acquiring a system access database, defining abnormal behavior identification rules to annotate the system access database with abnormal features, and obtaining a set of system access abnormal behavior feature samples. Specifically, all user access behavior data in the system are collected and recorded, including user ID, access time, accessed resources, operation type, etc., to form a system access database. According to business needs and security policies, a series of abnormal behavior identification rules are defined, including excessive access frequency, access to unauthorized resources, access during abnormal time periods, etc. The access behaviors in the system access database are annotated with abnormal features using the defined abnormal behavior identification rules, and data records that meet the abnormal behavior rules are annotated to form a set of system access abnormal behavior feature samples. S32: Model convergence training is performed on the system access abnormal behavior feature sample set to construct an abnormal access behavior feature identification model, and the abnormal access behavior feature identification model includes an abnormal behavior pattern recognition model and an abnormal behavior degree recognition model. Specifically, the machine learning model is trained using a set of labeled system access abnormal behavior feature samples, and the model performance is optimized by continuously adjusting the model parameters so that it can accurately identify abnormal access behaviors. After the training is completed, an abnormal access behavior feature recognition model is constructed. The abnormal access behavior feature recognition model includes two sub-models: an abnormal behavior pattern recognition model is used to identify whether the user access behavior conforms to the abnormal behavior pattern, such as whether the unauthorized resources are frequently accessed; an abnormal behavior degree recognition model is used to evaluate the abnormal degree of the user access behavior, such as the frequency and duration of abnormal access. S33: Based on the abnormal access behavior feature recognition model, the user access behavior information is analyzed abnormally, and the abnormal access behavior feature information is output. Specifically, the user access behavior information is input into the abnormal access behavior feature recognition model for abnormal analysis. The abnormal access behavior feature recognition model determines whether there is an abnormal behavior pattern based on the user access behavior data, and evaluates the degree of abnormal behavior. After the analysis is completed, the abnormal access behavior feature information is output, including the abnormal behavior type, abnormal degree, related user information, abnormal time, etc. This implementation method builds an abnormal access behavior feature recognition model, enabling the system to automatically identify and evaluate abnormal features in user access behavior, achieving the technical effect of improving the accuracy and efficiency of abnormal analysis.

[0061] S4: Perform access control analysis on the abnormal access behavior feature information, obtain a data security access policy, and perform access restriction protection on the access permission data information based on the data security access policy. Specifically, through data mining and pattern recognition technology, analyze the patterns in the abnormal access behavior feature information, identify possible attack behaviors or security risks, and conduct risk assessment on the target user's access behavior based on the identified attack behaviors or security risks to determine the potential threat level to the system data security. Based on the risk assessment results and the existing security policies, formulate a data security access policy. The data security access policy is formulated based on the access control analysis results, and is used to limit user access rights and protect system data security. It specifies which users or behaviors should be restricted, as well as the specific methods and extent of the restrictions. According to the data security access policy, update the user's access permission data information, restrict the target user's access rights to specific resources, prevent unauthorized access and data leakage, and implement new access control rules at the system's access control layer so that users can only access according to their new access permission data information. Continuously monitor the target user's access behavior to ensure the effective implementation of the data security access policy. If new abnormal access behavior is found, re-analyze and adjust the data security access policy. The embodiments of the present application adopt technical means such as sensitivity assessment, multi-dimensional identity authentication, dynamic access permission adjustment, access monitoring, anomaly analysis, access control analysis, and access restriction protection to achieve dynamic adjustment of access permissions and real-time monitoring of user access behavior, thereby achieving the technical effect of improving data security protection and effectively reducing the risk of data leakage and illegal access.

[0062] In a possible implementation, the obtaining of data security access policies further includes: obtaining a security access policy library, the security access policy library including historical abnormal access behavior feature data and corresponding security access policies. Specifically, the system's security access policy library is obtained, the security access policy library contains historical abnormal access behavior feature data and corresponding security access policies formulated for these abnormal behaviors. As time goes by, new abnormal access behavior data and its corresponding policies are continuously added to the security access policy library, and outdated data will be removed or updated to maintain the validity and timeliness of the security access policy library. Based on the abnormal access behavior feature information and the security access policy library, a similarity analysis is performed to obtain a set of security access policies within a preset similarity threshold. Specifically, when new abnormal access behavior feature information is identified, a similarity analysis is performed between it and the historical abnormal access behavior feature data in the security access policy library, and a similarity threshold is preset. When the similarity between the new feature and the feature in the security access policy library exceeds the similarity threshold, the two are considered to be similar. Through similarity analysis, find the historical abnormal access behavior feature data with similarity to the new feature within the preset similarity threshold, and obtain the corresponding security access policy to form a security access policy set. Perform multi-dimensional protection tests on the security access policy set to obtain an access policy security protection effect set, and filter the data security access policy based on the access policy security protection effect set. Specifically, perform multi-dimensional protection tests on the obtained security access policy set, including functional testing (verifying whether the policy can be executed correctly), performance testing (testing the execution efficiency and response time of the policy), security testing (simulating attacks to verify the security of the policy), etc. Through testing, evaluate the security protection effect of each access policy, and generate an access policy security protection effect set. According to the evaluation results, filter out the policy with the best security protection effect from the access policy security protection effect set as the data security access policy. This implementation method can quickly respond to new abnormal access behaviors and provide appropriate response strategies based on historical experience by building and maintaining a security access policy library. At the same time, through multi-dimensional protection testing, it ensures that the selected strategy is effective and secure, thereby protecting the security of data resources to the greatest extent, achieving the technical effect of improving the response speed and accuracy of the system and reducing data security risks caused by improper strategies.

[0063] In the above, refer to Figure 1 The access control method for data security protection according to an embodiment of the present invention is described in detail. Figure 2 An access control system for data security protection according to an embodiment of the present invention is described.

[0064] The access control system for data security protection according to the embodiment of the present invention is used to solve the technical problems of low security protection effect and data leakage risk in the existing data access control, so as to achieve the technical effect of improving data security protection effect and effectively reducing the risk of data leakage and illegal access. The access control system for data security protection includes: a target security verification method acquisition module 10, an access permission data information acquisition module 20, an abnormal access behavior feature information acquisition module 30, and an access restriction protection module 40.

[0065] The target security verification method acquisition module 10 is used to obtain user access request information, perform sensitivity assessment on the user access request information, obtain access data sensitivity information, match the access data sensitivity information with the security verification method library, and obtain the target security verification method;

[0066] The access permission data information acquisition module 20 is used to perform multi-dimensional identity authentication on the target user based on the target security verification method to obtain a security verification result. When the security verification result is passed, the target user is dynamically adjusted for access permission through the user access request information to obtain access permission data information.

[0067] The abnormal access behavior characteristic information acquisition module 30 is used to monitor the access to the access permission data information by the target user, obtain the user access behavior information, perform abnormal analysis on the user access behavior information, and obtain abnormal access behavior characteristic information;

[0068] The access restriction protection module 40 is used to perform access control analysis on the abnormal access behavior feature information, obtain a data security access policy, and perform access restriction protection on the access permission data information based on the data security access policy.

[0069] The specific configuration of the target security verification method acquisition module 10 will be described in detail below. As described above, to obtain the access data sensitivity information, the target security verification method acquisition module 10 may further include: an access data parsing unit for acquiring the target access data system, performing access data parsing on the target access data system, and obtaining the target access data architecture information; a data description factor information construction unit for constructing data description factor information, the data description factor information including data type, data level, data dimension and source range; a feature description unit for performing feature description on each access data in the target access data architecture information based on the data description factor information, and obtaining the target access data description feature information; a sensitivity assessment unit for constructing a data sensitivity discriminator based on the target access data description feature information, and performing sensitivity assessment on the user access request information based on the data sensitivity discriminator, and obtaining the access data sensitivity information.

[0070] Among them, the sensitivity assessment unit for constructing the data sensitivity discriminator may further include: a discriminant content identification subunit for performing discriminant content identification on the data description factor information based on the target access data description feature information, and obtaining a data description factor discriminant content node set; a sensitivity division subunit for performing sensitivity division on the data description factor information according to data management standards, and defining data description factor sensitivity division rules; a sensitivity identification subunit for performing sensitivity identification on the data description factor discriminant content node set based on the data description factor sensitivity division rules, and obtaining a data content node description factor sensitivity set; a data sensitivity discriminator training construction subunit for performing factor weighted calculation on the data content node description factor sensitivity set, and obtaining a data content node sensitivity information set, and training and constructing the data sensitivity discriminator based on the data description factor discriminant content node set and the data content node sensitivity information set.

[0071] The specific configuration of the access permission data information acquisition module 20 will be described in detail below. As described above, to obtain the access permission data information, the access permission data information acquisition module 20 may further include: a target user role permission information determination unit is used to obtain the role tag information of the target user, and determine the target user role permission information based on the matching of the role tag information and the system role permission library; an access context environment characteristic information acquisition unit is used to identify the context environment of the target user and obtain the access context environment characteristic information; an access permission matching unit is used to match the access permission information of the access context environment characteristic information according to the preset environment access rules to obtain the target environment access permission information; a content mapping unit is used to content-map the intersection of the target user role permission information and the target environment access permission information with the user access request information to obtain the access permission data information.

[0072] Among them, the content mapping unit for obtaining the access permission data information may further include: a factor permission division subunit for performing factor permission division on each system role in the system role permission library according to the data description factor information, and obtaining a system role factor permission label set; a mapping matching subunit for performing mapping and matching based on the system role factor permission label set and the target access data architecture information, and obtaining a system role permission access data content set; a content division subunit for performing content division on the target access data architecture information according to the preset environment access rule, and obtaining an environment permission access data content set; a matching intersection subunit for matching and intersecting the target user role permission information with the system role permission access data content set, and the target environment access permission information with the environment permission access data content set, and obtaining accessible data intersection content information; and an access permission data information acquisition subunit for performing content mapping based on the accessible data intersection content information and the user access request information, and obtaining the access permission data information.

[0073] The specific configuration of the abnormal access behavior characteristic information acquisition module 30 will be described in detail below. As described above, to acquire abnormal access behavior characteristic information, the abnormal access behavior characteristic information acquisition module 30 may further include: an abnormal characteristic annotation unit for collecting and acquiring a system access database, defining abnormal behavior identification rules to annotate the system access database with abnormal characteristics, and obtaining a set of system access abnormal behavior characteristic samples; an abnormal access behavior characteristic identification model construction unit for performing model convergence training on the system access abnormal behavior characteristic sample set, and constructing an abnormal access behavior characteristic identification model, wherein the abnormal access behavior characteristic identification model includes an abnormal behavior pattern recognition model and an abnormal behavior degree recognition model; an abnormal analysis unit for performing abnormal analysis on the user access behavior information based on the abnormal access behavior characteristic identification model, and outputting the abnormal access behavior characteristic information.

[0074] The specific configuration of the access restriction protection module 40 will be described in detail below. As described above, to obtain the data security access policy, the access restriction protection module 40 may further include: a security access policy library acquisition unit for obtaining a security access policy library, the security access policy library including historical abnormal access behavior feature data and corresponding security access policies; a similarity analysis unit for performing similarity analysis with the security access policy library based on the abnormal access behavior feature information, and obtaining a security access policy set within a preset similarity threshold; a screening unit for performing a multi-dimensional protection test on the security access policy set, obtaining an access policy security protection effect set, and screening the data security access policy according to the access policy security protection effect set.

[0075] The access control system for data security protection provided by the embodiment of the present invention can execute the access control method for data security protection provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0076] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0077] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. An access control method for data security protection, characterized in that: The method comprises: S1: obtaining user access request information, performing sensitivity assessment on the user access request information, obtaining access data sensitivity information, matching the access data sensitivity information with a security verification method library, and obtaining a target security verification method; S2: Perform multi-dimensional identity authentication on the target user based on the target security authentication method to obtain a security authentication result. When the security authentication result is passed, dynamically adjust the access permission of the target user according to the user access request information to obtain access permission data information; S3: monitoring the access to the access permission data information by the target user, obtaining the user access behavior information, performing abnormal analysis on the user access behavior information, and obtaining abnormal access behavior feature information; S4: Performing access control analysis on the abnormal access behavior feature information to obtain a data security access policy, and performing access restriction protection on the access permission data information based on the data security access policy; The access permission data information obtained in S2 includes: S21: Obtain the role tag information of the target user, and determine the role authority information of the target user based on matching the role tag information with the system role authority library; S22: Identify the context of the target user and obtain access context feature information; S23: matching the access permission of the access context environment feature information according to the preset environment access rule to obtain the target environment access permission information; S24: performing content mapping on the intersection of the target user role permission information and the target environment access permission information and the user access request information to obtain the access permission data information; The step of obtaining the access permission data information in S24 includes: According to the data description factor information, each system role in the system role permission library is divided into factor permissions, and a system role factor permission label set is obtained; Based on the mapping and matching of the system role factor permission tag set and the target access data architecture information, a system role permission access data content set is obtained; Dividing the target access data architecture information into content according to the preset environment access rules to obtain an environment authority access data content set; Match and intersect the target user role permission information with the system role permission access data content set, and the target environment permission access information with the environment permission access data content set, to obtain accessible data intersection content information; Performing content mapping based on the accessible data intersection content information and the user access request information to obtain the accessible data information; The obtaining of data security access strategy includes: Acquire a security access policy library, wherein the security access policy library includes historical abnormal access behavior feature data and corresponding security access policies; Performing similarity analysis based on the abnormal access behavior feature information and the security access policy library to obtain a security access policy set within a preset similarity threshold; A multi-dimensional protection test is performed on the security access policy set to obtain an access policy security protection effect set, and the data security access policy is obtained by screening according to the access policy security protection effect set.

2. The access control method for data security protection according to claim 1, characterized in that: The access data sensitivity information obtained in S1 includes: S11: Acquire a target access data system, perform access data analysis on the target access data system, and obtain target access data architecture information; S12: constructing data description factor information, wherein the data description factor information includes data type, data level, data dimension and source range; S13: Based on the data description factor information, feature description is performed on each access data in the target access data architecture information to obtain target access data description feature information; S14: constructing a data sensitivity discriminator according to the target access data description feature information, and performing a sensitivity assessment on the user access request information based on the data sensitivity discriminator to obtain the access data sensitivity information.

3. The access control method for data security protection according to claim 2, characterized in that: The data sensitivity discriminator is constructed in S14, including: Based on the target access data description feature information, the data description factor information is identified for content discrimination to obtain a data description factor identification content node set; According to the data management standard, the data description factor information is divided into sensitivity levels, and the sensitivity division rules of the data description factors are defined; Based on the data description factor sensitivity classification rule, the data description factor discrimination content node set is subjected to sensitivity identification to obtain a data content node description factor sensitivity set; The sensitivity set of the data content node description factors is subjected to factor weighted calculation to obtain a data content node sensitivity information set, and the data sensitivity discriminator is trained and constructed based on the data description factor discrimination content node set and the data content node sensitivity information set.

4. The access control method for data security protection according to claim 1, characterized in that: The abnormal access behavior feature information obtained in S3 includes: S31: Collect and obtain a system access database, define abnormal behavior recognition rules to annotate the system access database with abnormal features, and obtain a sample set of system access abnormal behavior features; S32: performing model convergence training on the system access abnormal behavior feature sample set to construct an abnormal access behavior feature recognition model, wherein the abnormal access behavior feature recognition model includes an abnormal behavior pattern recognition model and an abnormal behavior degree recognition model; S33: Performing an abnormal analysis on the user access behavior information based on the abnormal access behavior feature recognition model, and outputting the abnormal access behavior feature information.

5. An access control system for data security protection, characterized in that: The system is used to implement the access control method for data security protection according to any one of claims 1 to 4, and the system includes: A target security verification method acquisition module, the target security verification method acquisition module is used to obtain user access request information, perform sensitivity assessment on the user access request information, obtain access data sensitivity information, and match the access data sensitivity information with a security verification method library to obtain a target security verification method; an access permission data information acquisition module, the access permission data information acquisition module is used to perform multi-dimensional identity authentication on the target user based on the target security verification method to obtain a security verification result, and when the security verification result is passed, dynamically adjust the access permission of the target user through the user access request information to obtain the access permission data information; An abnormal access behavior characteristic information acquisition module is used to monitor the access to the access permission data information by the target user, obtain the user access behavior information, perform abnormal analysis on the user access behavior information, and obtain abnormal access behavior characteristic information; An access restriction protection module is used to perform access control analysis on the abnormal access behavior feature information, obtain a data security access policy, and perform access restriction protection on the accessible data information based on the data security access policy.

Images