Database access method and device, electronic device and storage medium

Abstract

The present invention provides a database access method and device, an electronic device and a storage medium, which can be applied to the field of database testing technology. The database access method includes: obtaining access request information and user information of a user to access a database, wherein the access request information includes the access time and geographical location, and the user information includes the user role and access frequency of the user; inputting the user role and access time into a trained level prediction classification model to obtain the user's first risk level; inputting the geographical location and access frequency into a trained fully connected neural network model to obtain the user's second risk level; comparing the actual distance of the geographical location change from the geographical location when the user last logged in with the change distance of the preset artificially reachable geographical location, and obtaining the user's third risk level according to the comparison result; determining the user's database access control method according to the first risk level, the second risk level and the third risk level.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a database access method and device, electronic equipment and storage medium. Background Art

[0002] With the development of information technology and the widespread application of database systems, database access control has become the key to ensuring data security. However, traditional access control methods mainly rely on static strategies and are difficult to cope with complex and changing security environments. Therefore, there is an urgent need for a database access control system that can combine multiple access control methods and has adaptive capabilities to improve the security and flexibility of the system. Summary of the invention

[0003] In view of the above problems, the present invention provides a database access method, apparatus, device and storage medium.

[0004] According to a first aspect of the present invention, a database access method is provided, characterized in that it includes: obtaining access request information and user information of a user for accessing a database, wherein the access request information includes access time and geographical location, and the user information includes the user role and access frequency of the user; inputting the user role and access time into a trained level prediction classification model to obtain the user's first risk level; inputting the geographical location and access frequency into a trained fully connected neural network model to obtain the user's second risk level; comparing the actual distance of the geographical location change from the geographical location when the user last logged in with the change distance of the preset artificially reachable geographical location, and obtaining the user's third risk level according to the comparison result; determining the user's database access control method according to the first risk level, the second risk level and the third risk level.

[0005] According to an embodiment of the present invention, determining a database access control method for a user based on a first risk level, a second risk level, and a third risk level includes: determining a first weight corresponding to the first risk level; determining a second weight corresponding to the second risk level; determining a third weight corresponding to the third risk level; determining a fourth risk level for the user based on the first risk level with the first weight, the second risk level with the second weight, and the third risk level with the third weight; and determining a database access control method for the user based on the fourth risk level.

[0006] According to an embodiment of the present invention, the database access control method includes at least one of role-based access control, autonomous access control and mandatory access control.

[0007] According to an embodiment of the present invention, judgments are made one by one according to the access request information and the rules of the determined user database access control method to obtain the judgment results of each access control method; when the judgment results of each access control method are all passed, the user's access request is allowed.

[0008] According to an embodiment of the present invention, the fourth risk level includes low, medium, and high risk levels.

[0009] According to an embodiment of the present invention, determining the user's database access control method based on the fourth risk level includes: when the fourth risk level is low, determining the access method to be role-based access control; when the fourth risk level is medium, determining the access method to be role-based access control and autonomous access control; when the fourth risk level is high, determining the access method to be role-based access control, autonomous access control and mandatory access control.

[0010] The second aspect of the present invention provides a database access device, including: an acquisition module, used to obtain a user's access request information and user information for accessing a database, wherein the access request information includes the access time and geographic location, and the user information includes the user role and access frequency of the user; a first judgment module, used to input the user role and access time into a trained level prediction classification model to obtain the user's first risk level; a second judgment module, used to input the geographic location and access frequency into a trained fully connected neural network model to obtain the user's second risk level; a third judgment module, used to compare the actual distance of the geographic location change from the geographic location when the user last logged in with the change distance of the preset artificially reachable geographic location, and obtain the user's third risk level according to the comparison result; a decision module, used to determine the user's database access control method according to the first risk level, the second risk level and the third risk level.

[0011] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, and when the one or more processors execute the one or more computer programs, the steps of the above-mentioned database access method are implemented.

[0012] The fourth aspect of the present invention further provides a computer-readable storage medium on which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the steps of the above-mentioned database access method are implemented.

[0013] According to an embodiment of the present invention, when a user accesses a database, by predicting the user's role and access time, the risk level can be judged according to the user's role and the historical common access time of this type of role; by using a fully connected neural network model to judge the user's geographical location and access frequency, the user's access behavior pattern can be more accurately identified, and normal and abnormal access can be distinguished; by comparing the geographical location change with the actual geographical location change and monitoring the change of the user's login location, possible account theft or abnormal access behavior in the virtual geographical location can be detected, and a comprehensive conclusion can be obtained based on the first, second, and third risk levels to more accurately distinguish whether the user's access behavior is abnormal. The system can automatically adjust permissions to prevent potential security threats, thereby greatly improving the overall security of the database. At the same time, it can reduce the erroneous judgment caused by a single factor and improve the accuracy of the security system. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0015] Figure 1 An application scenario of the database access method according to an embodiment of the present invention is shown;

[0016] Figure 2 A flowchart of a database access method according to an embodiment of the present invention is shown;

[0017] Figure 3 A flowchart of a method for determining database access according to weights according to an embodiment of the present invention is shown;

[0018] Figure 4 A flowchart of a method for determining database access according to the fourth level according to an embodiment of the present invention is shown;

[0019] Figure 5 It shows a structural block diagram of a database access device according to an embodiment of the present invention;

[0020] Figure 6 A block diagram of an electronic device for accessing a database according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0021] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0022] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0023] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0024] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0025] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0026] It should be noted that the database access method and device, electronic device and storage medium of the embodiments of the present invention can be applied to the fields of big data technology, database technology and database testing technology, and can also be used in any field other than the fields of big data technology, database technology and database testing technology. The embodiments of the present invention do not limit the application fields of the above-mentioned database access method and device, electronic device and storage medium.

[0027] An embodiment of the present invention provides a database access method, comprising the following operations: obtaining access request information and user information of a user for accessing a database, wherein the access request information includes access time and geographic location, and the user information includes the user role and access frequency of the user; inputting the user role and access time into a trained level prediction classification model to obtain the user's first risk level; inputting the geographic location and access frequency into a trained fully connected neural network model to obtain the user's second risk level; comparing the actual distance of the geographic location change from the geographic location when the user last logged in with the change distance of a preset artificially reachable geographic location, and obtaining the user's third risk level according to the comparison result; determining the user's database access control method according to the first risk level, the second risk level and the third risk level.

[0028] Figure 1 The application scenario of the database access method according to the embodiment of the present invention is shown.

[0029] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0030] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0032] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0033] It should be noted that the database access method provided in the embodiment of the present invention can generally be executed by the server 105. Accordingly, the distributed database access device provided in the embodiment of the present invention can generally be set in the server 105. The database access method provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the distributed database access device provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0035] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The database access method according to the embodiment of the present invention is described in detail.

[0036] Figure 2 A flowchart of a database access method according to an embodiment of the present invention is shown.

[0037] like Figure 2 As shown, the method includes operations S201 to S204.

[0038] In operation S201, access request information and user information of a user to access a database are obtained, wherein the access request information includes access time and geographic location, and the user information includes the user role and access frequency of the user.

[0039] In operation S202, the user role and access time are input into a trained level prediction classification model to obtain a first risk level of the user.

[0040] In operation S203, the geographical location and the visit frequency are input into the trained fully connected neural network model to obtain a second risk level of the user.

[0041] In operation S204, the actual distance of the geographical location change from the geographical location when the user last logged in is compared with the change distance of the preset artificially reachable geographical location, and the third risk level of the user is obtained according to the comparison result.

[0042] In operation S205, a database access control mode of the user is determined according to the first risk level, the second risk level, and the third risk level.

[0043] According to an embodiment of the present invention, when a user accesses a database, by predicting the user's role and access time, the risk level can be judged according to the user's role and the historical common access time of this type of role; by using a fully connected neural network model to judge the user's geographical location and access frequency, the user's access behavior pattern can be more accurately identified and normal and abnormal access can be distinguished; by comparing the geographical location change with the actual geographical location change and monitoring the change of the user's login location, possible account theft or abnormal access behavior of the virtual geographical location can be detected, and according to the first, second, and third risk levels, a comprehensive conclusion can be obtained to more accurately distinguish whether the user's access behavior is abnormal, and the system can automatically adjust the permissions to prevent potential security threats, thereby greatly improving the overall security of the database, and at the same time, it can reduce the misjudgment caused by a single factor and improve the accuracy of the security system. The design adds behavioral analysis and prediction capabilities based on historical data, which can intelligently evaluate the user's access behavior, not only improving the security protection level of the system, but also reducing the workload of security managers and avoiding security vulnerabilities caused by human configuration errors. Traditional access control systems require manual regular updating and maintenance of rule sets, while the present invention achieves automated rule optimization and adjustment through machine learning, reducing reliance on manual intervention, which not only reduces operation and maintenance costs but also reduces the risk of human error, thereby improving system reliability and stability.

[0044] In some embodiments of the present invention, although the risk level prediction and evaluation process requires a certain amount of computing time, its intelligent advantages ensure that a smooth user experience can be provided in most cases. For example, on an Internet financial platform, the system can ensure that users can still enjoy a fast and secure service experience when visiting during peak hours without the need for additional identity verification steps.

[0045] According to an embodiment of the present invention, in operation S201, user information includes access request information, including access time and geographic location, such as the user's request time is 17:00 on a certain day of a certain month of a certain year, and the geographic location is determined according to the IP address of the accessing user, such as a certain city, or more accurately to a specific street or landmark according to the IP positioning of the operator. The user role in the user information is determined according to the preset role of the database to be accessed, such as the user role of the database to be accessed is preset as management personnel, operation and maintenance personnel, ordinary users and external users, etc., and the preset role of the user is determined in advance. For example, if the user is not in the preset list of management personnel, operation and maintenance personnel and ordinary users, the user role of the external user is assigned. The user's access frequency can be determined by calling the user's access history accordingly. For example, if the frequency is preset to "times / day", the number of times the user accesses the database every day is the access frequency, and the access frequency can also be set to "times / month", "times / 10 days", "times / 20 days", etc. according to actual business needs.

[0046] According to an embodiment of the present invention, in operation S202, the level prediction classification model is trained based on the historical data of the database to be accessed, and the trained level prediction classification model can make a judgment based on the role and access time of the accessing user, and obtain the first risk level based on the pre-set level. For example, the trained level prediction classification model judges based on historical data that the login time of operation and maintenance personnel is mostly in the middle of the night, the login time of management personnel is mostly in the morning, and the access time of ordinary users is mostly during daytime working hours, so the trained level prediction classification model can be used to judge the risk level of the user's current visit based on the user's role and access time.

[0047] In some specific embodiments of the present invention, the training process of the grade prediction classification model may include collecting data on user roles and access times in historical data; cleaning the data to remove invalid or erroneous records; standardizing or normalizing the data. If the user role is categorical data, encoding may be required, such as using One-Hot Encoding; converting the access time into a format acceptable to the model. For example, if the time is in a date and time format, it may need to be converted into the number of days or seconds since a specific date; selecting a suitable algorithm according to the type of database and data characteristics, such as decision trees, random forests, gradient boosting, support vector machines, neural networks, etc.; dividing the training set and validation set for model training and validation, and correcting and adjusting the model according to actual conditions, and updating the model regularly based on new data and feedback.

[0048] According to an embodiment of the present invention, the use of a prediction model can avoid misjudgment. For example, access at midnight will always be considered as abnormal access time. However, in the actual production process, operation and maintenance personnel mostly log in during off-peak hours such as at night to perform database maintenance and upgrades. If logins from 22:00 to 06:00 are generally considered abnormal logins, misjudgment will occur.

[0049] According to an embodiment of the present invention, in operation S203, the user's access frequency and geographical location can be comprehensively judged through the trained fully connected neural network model. By predicting the nonlinear relationship between the access frequency and the geographical location, it is determined whether the user's access behavior is normal. For example, if the user accesses the database 20 times per minute, or uses different IP addresses for high-frequency access within a period of time, it will be regarded as abnormal access behavior. The neural network model will perform a large amount of data training through a training set of historical data. After inputting the access request information and user information of the user to be accessed, the user's access risk level can be judged.

[0050] In some embodiments of the present invention, the training method of the fully connected neural network is as follows.

[0051] Operation S1: Construct a training data set and a test set. The training set is used for model training, and the test set is used for model verification. The data used include the user's geographic location and access frequency characteristics. The data is obtained by screening from historical log data and then normalized. Different attribute values ​​are normalized to the range of [0, 1] to facilitate neural network processing.

[0052] Operation S2: Fully connected neural network design. The constructed fully connected neural network model includes an input layer, two hidden layers and an output layer. The number of nodes in the input layer is equal to the number of features, and the number of nodes in the output layer is the number of classifications. In the present invention, the classification is divided into three risk categories: low, medium and high. The corresponding second risk level is set to low, medium and high. The activation function uses the sigmoid function, the output layer uses the softmax function, and the loss function is the cross entropy cost function. The specific structure is as follows.

[0053] Input layer: Receives preprocessed user geographic location and access frequency data. Each input node corresponds to an attribute value.

[0054] Hidden layer: contains several neurons, using sigmoid function as activation function. The output range of sigmoid function is between [0, 1].

[0055] It is defined as: .

[0056] Output layer: contains three neurons, corresponding to the three risk categories of low, medium and high. The output value is converted into probability using the softmax function. The output value of the softmax function is a probability distribution. The sum of all output values ​​is 1. It is suitable for multi-classification problems. It is defined as: .

[0057] in Represents the first elements, Represents an index that traverses all categories.

[0058] Loss function: The cross entropy cost function is used to measure the difference between the model prediction and the actual result, which needs to be minimized as much as possible. It is defined as: .

[0059] in represents the actual distribution (true value), Represents the probability distribution of the prediction.

[0060] Operation S3: Model training, input the training set data into the fully connected neural network, calculate the output through forward propagation, update the weights and biases through back propagation, and iterate the training until the loss function converges; model testing, input the test set data into the trained model, calculate the output through forward propagation, and evaluate the model performance.

[0061] In some embodiments of the present invention, it also includes regularly auditing and analyzing log data, extracting new data from the logs and adding it to the historical data set, performing data preprocessing, feature selection, model training and verification and other operations on the updated historical data to iteratively optimize the neural network model, thereby improving the accuracy of the model.

[0062] In some specific embodiments of the present invention, in step S1, the historical log data may be as shown in Table 1 below.

[0063] Table 1

[0064]

[0065] In some specific embodiments of the present invention, in step S1, the data conversion and processing may segment the IP address of the geographic location, convert the IP address into four numerical values, for example, 1.1.1.1 is converted into [1, 1, 1, 1], and then normalize each numerical value, for example, divide it by 255. The access frequency is normalized according to the maximum access frequency, for example, assuming that the maximum access frequency is 5 times per day, the frequency 3 times is normalized to 3 / 5 = 0.6.

[0066] In some specific embodiments of the present invention, the user role and access time data can be converted and added to the fully connected neural network for second risk level prediction, and the user role can be converted from category data to numerical data, for example, ordinary users can be converted to 0 and administrators can be converted to 1. The access time can also be converted to the number of minutes in a day and then normalized. For example, 10:00 can be converted to 600 minutes and divided by the total number of minutes in a day, 1440, to obtain 0.4167. The user ID can also be represented by an embedded vector, for example, user IDs 1001, 1002, and 1003 can be mapped to low-dimensional vectors.

[0067] In some specific embodiments of the present invention, the processed data are shown in Table 2 below.

[0068] Table 2

[0069]

[0070] In some specific embodiments of the present invention, in step S2, the fully connected neural network design can be designed as an input layer: 5 nodes including geographic location 1, geographic location 2, geographic location 3, geographic location 4, and visit frequency; hidden layer: two hidden layers, the activation function is sigmoid; output layer: 3 nodes, low risk, medium risk, high risk, the activation function is softmax; loss function: cross entropy cost function.

[0071] In some specific embodiments of the present invention, when the neural network model is selected as the grade prediction classification model, the user role, access time, geographic location and access frequency in step S202 and step S203 can be input into the trained neural network model to obtain a comprehensive risk level that integrates the first risk level and the second risk level. For example, the input layer of the neural network model can be designed as 8 nodes as shown in Table 2, including user ID, user role, access time, geographic location 1, geographic location 2, geographic location 3, and geographic location 4.

[0072] In some specific embodiments of the present invention, in step S3, the training step includes data segmentation, for example, dividing the data set into 80% training set and 20% test set; forward propagation: calculating output; back propagation: updating weights and biases through the back propagation algorithm; iterative training: repeatedly performing forward propagation and back propagation until the loss function converges. It may also include model evaluation: using the test set to evaluate the performance of the model, and evaluating the model through indicators such as accuracy, recall rate and F1-score.

[0073] In some specific embodiments of the present invention, traditional access control systems are usually based on static rule sets and are difficult to cope with complex and changeable access scenarios. However, by utilizing a neural network model, it is possible to learn and optimize based on the user's historical behavior data and calculate the risk level. This adaptive capability enables the system to respond quickly to new threats and provide higher security.

[0074] According to an embodiment of the present invention, in operation S204, when the user logs in, the geographical location and time difference of the user's last login are retrieved, and the time difference is compared with the preset artificially accessible geographical location change example. For example, the database background sets the hourly accessible geographical location change between 0 and 800 km as normal, which can be set to a low risk level, 800 km to 1200 km as a medium risk level, and above 1200 km as a high risk level, that is, an abnormal geographical location change. The third risk level is obtained by comparing the distance and time difference between the geographical location visited by the user this time and the geographical location changed last time with the preset value. The possible risk of account theft can be detected by judging the geographical location change.

[0075] According to an embodiment of the present invention, in step S203 to step S204, due to the operator or other reasons, the geographic location IP may not be accurate to a specific location, for example, it may only be accurate to a city. At this time, the judgment of S204 may not be accurate enough. However, by judging the risk level twice in step S203 and step S204, it is possible to refine and accurately detect that an account may be stolen and logged in, or abnormal behaviors such as frequent logins from virtual geographic locations can be detected, thereby affecting the determination of the access control method for visiting users and further the security of the database.

[0076] According to an embodiment of the present invention, in step S205, according to the first, second and third risk level results, for example, different weights can be set according to actual conditions to determine the database access control method for the user to be accessed. The first, second and third risk levels can be set to different levels according to actual needs, for example, the first risk level can be set to three levels of low, medium and high, the second risk level can be set to level one, level two, level three, level four and level five, and the third risk level can be set to low risk and high risk according to the threshold range of judgment, etc., and the access control method for the user to access the database is determined according to the preset calculation rules of the three risk levels.

[0077] Figure 3 A flow chart of a method for determining database access according to weights according to an embodiment of the present invention is shown.

[0078] like Figure 3 As shown, the method includes operations S301 to S309.

[0079] In operation S301, access request information and user information of a user to access a database are obtained, wherein the access request information includes access time and geographic location, and the user information includes the user role and access frequency of the user.

[0080] In operation S302, the user role and access time are input into a trained level prediction classification model to obtain a first risk level of the user.

[0081] In operation S303, the geographic location and the visit frequency are input into the trained fully connected neural network model to obtain a second risk level of the user.

[0082] In operation S304, the actual distance of the geographical location change from the geographical location when the user last logged in is compared with the change distance of the preset artificially reachable geographical location, and the third risk level of the user is obtained according to the comparison result.

[0083] In operation S305 , a first weight corresponding to the first risk level is determined.

[0084] In operation S306 , a second weight corresponding to the second risk level is determined.

[0085] In operation S307 , a third weight corresponding to the third risk level is determined.

[0086] In operation S308 , a fourth risk level of the user is determined according to the first risk level having the first weight, the second risk level having the second weight, and the third risk level having the third weight.

[0087] In operation S309, a database access control mode of the user is determined according to the fourth risk level.

[0088] According to an embodiment of the present invention, different first, second and third weights can be assigned to the first, second and third risks according to the actual function or application scenario of the database to be accessed, and then the final fourth risk level can be calculated according to the risk level with weights, and the database access control method can be determined using the fourth risk level. For example, in the historical use of the database to be accessed, there are frequent cases of hacked logins from other places, and the second and third weights can be increased accordingly, and then the geographical location and frequency of the login users can be more strictly reviewed and controlled, and the access control of abnormal users can be more strictly performed.

[0089] According to an embodiment of the present invention, the fourth risk level includes low, medium, and high risk levels.

[0090] According to an embodiment of the present invention, before the fourth level is determined, the first risk level, the second risk level and the third risk level should be normalized so that all their weight values ​​are in the same dimension, and then the fourth risk level is calculated and determined.

[0091] According to an embodiment of the present invention, the fourth risk level can be determined by the first, second, and third risk levels with different weights. For example, a weight of 0.4 is assigned to the first risk level, a weight of 0.3 is assigned to the second risk level, and a weight of 0.3 is assigned to the third risk level. The calculation result of the fourth risk level is obtained according to the weights, and then the fourth risk level is judged according to the preset fourth risk level. For example, the first risk level result is 10 points, the second risk level result is 15 points, and the third risk level result is 10 points. Then, the fourth risk level result after weight calculation is 11.5 points. If the preset fourth risk level is 0-10 points for low level, 10-15 points for medium level, and 15 points or above for high level, then the result of the fourth risk level being medium can be obtained.

[0092] According to an embodiment of the present invention, the database access control method includes at least one of role-based access control, autonomous access control and mandatory access control.

[0093] According to an embodiment of the present invention, role-based access control (RBAC) is a method of associating permissions with roles, and users obtain corresponding permissions through assigned roles. Roles can be assigned based on the user's responsibilities and tasks to be performed. Discretionary access control (DAC) is a method that allows the owner of data to independently decide who can access their data and the level of access permissions. For example, the owner of a file or database record can decide to grant or revoke read, write or execute permissions to other users. Mandatory access control (MAC) is a method that is usually used in a high-security environment and enforces access control based on predefined security policies. All data and users are assigned security levels, and the system automatically restricts access based on these levels. For example, a user with a "confidential" security level can only access data with the same or lower "confidential" level. The combined use of the above three access control methods can provide multi-layer security protection to ensure the security and integrity of data. At the same time, different access control strategies can adapt to different types of data and user needs and provide more detailed access management.

[0094] Figure 4 A flow chart of a method for determining database access according to the fourth level according to an embodiment of the present invention is shown.

[0095] like Figure 4 As shown, the method includes operations S401 to S411.

[0096] In operation S401, access request information and user information of a user to access a database are obtained, wherein the access request information includes access time and geographic location, and the user information includes the user role and access frequency of the user.

[0097] In operation S402, the user role and access time are input into a trained level prediction classification model to obtain a first risk level of the user.

[0098] In operation S403, the geographic location and the visit frequency are input into the trained fully connected neural network model to obtain a second risk level of the user.

[0099] In operation S404, the actual distance of the geographical location change from the geographical location when the user last logged in is compared with the change distance of the preset artificially reachable geographical location, and the third risk level of the user is obtained according to the comparison result.

[0100] In operation S405 , a first weight corresponding to the first risk level is determined.

[0101] In operation S406 , a second weight corresponding to the second risk level is determined.

[0102] In operation S407, a third weight corresponding to the third risk level is determined.

[0103] In operation S408, a fourth risk level of the user is determined according to the first risk level having the first weight, the second risk level having the second weight, and the third risk level having the third weight.

[0104] In operation S409, when the fourth risk level is low, the access mode is determined to be role-based access control.

[0105] In operation S410, when the fourth risk level is medium, the access mode is determined to be role-based access control and autonomous access control.

[0106] In operation S411, when the fourth risk level is high, the access mode is determined to be role-based access control, autonomous access control, and mandatory access control.

[0107] According to an embodiment of the present invention, role-based access control (RBAC) can be used as the first checkpoint to determine whether a user has basic permissions to access resources. RBAC assigns permissions based on user roles. If the user role and the access to the requested resource are low risk, access is allowed. Otherwise, access is denied. Low-risk access control can be performed here.

[0108] According to an embodiment of the present invention, discretionary access control (DAC) can be used as a second checkpoint to further control medium-risk access requests. DAC determines access rights based on the settings of the user or the object owner. After passing RBAC, medium-risk users must pass DAC to access resources. Medium-risk access control can be performed here.

[0109] According to an embodiment of the present invention, mandatory access control (MAC) can be used as a third checkpoint to control high-risk access requests. MAC strictly controls high-risk users based on the system's security policy. After passing RBAC and DAC, high-risk users must pass MAC to access resources. High-risk access control can be performed here.

[0110] In some embodiments of the present invention, for high-risk access requests, the system can trigger corresponding security response measures, such as multi-factor authentication and account locking.

[0111] According to an embodiment of the present invention, judgments are made one by one based on the data and operation type requested by the user and the rules of each access control method preset in the database to be accessed, and the judgment results of each access control method are obtained; when the judgment results of each access control method are all passed, the user's access request is allowed.

[0112] According to an embodiment of the present invention, after determining the access control method, a judgment is made based on the preset information and user information of each access control method to obtain a judgment result of each access control method. For example, a judgment is made based on the preset user role and the task to be performed by the access request information. If it is consistent with the permissions preset by the database administrator for the user, it is considered as role-based access control and the judgment result is pass. If a judgment result of mandatory access control is to be obtained, a judgment is made based on the permissions preset by the system for the user and the content or level of the content to be accessed in the user's access request information. If it is within the access permissions preset by the database administrator for the user, it is considered as pass.

[0113] Figure 5 A structural block diagram of a database access device according to an embodiment of the present invention is shown.

[0114] like Figure 5 As shown, the database access device 500 of this embodiment includes an acquisition module 510 , a first judgment module 520 , a second judgment module 530 , a third judgment module 540 and a decision module 550 .

[0115] The acquisition module 510 is used to obtain the user's access request information and user information for accessing the database, wherein the access request information includes the access time and geographical location, and the user information includes the user role and access frequency of the user. In one embodiment, the acquisition module 510 can be used to perform the operation S201 described above, which will not be repeated here.

[0116] The first judgment module 520 is used to input the user role and access time into the trained level prediction classification model to obtain the user's first risk level. In one embodiment, the first judgment module 520 can be used to perform the operation S202 described above, which will not be repeated here.

[0117] The second judgment module 530 is used to input the geographical location and the access frequency into the trained fully connected neural network model to obtain the second risk level of the user. In one embodiment, the second judgment module 530 can be used to perform the operation S203 described above, which will not be repeated here.

[0118] The third judgment module 540 is used to compare the actual distance between the geographical location and the geographical location when the user last logged in with the change distance of the preset artificially reachable geographical location, and obtain the third risk level of the user according to the comparison result. In one embodiment, the third judgment module 540 can be used to perform the operation S204 described above, which will not be repeated here.

[0119] The decision module 550 is used to determine the user's database access control mode according to the first risk level, the second risk level and the third risk level. In one embodiment, the decision module 550 can be used to perform the operation S205 described above, which will not be described in detail here.

[0120] According to an embodiment of the present invention, when a user accesses a database, by predicting the user's role and access time, the risk level can be judged according to the user's role and the historical common access time of this type of role; by using a fully connected neural network model to judge the user's geographical location and access frequency, the user's access behavior pattern can be more accurately identified, and normal and abnormal access can be distinguished; by comparing the geographical location change with the actual geographical location change and monitoring the change of the user's login location, possible account theft or abnormal access behavior in the virtual geographical location can be detected, and a comprehensive conclusion can be obtained based on the first, second, and third risk levels to more accurately distinguish whether the user's access behavior is abnormal. The system can automatically adjust permissions to prevent potential security threats, thereby greatly improving the overall security of the database. At the same time, it can reduce the erroneous judgment caused by a single factor and improve the accuracy of the security system.

[0121] According to an embodiment of the present invention, at least one of the acquisition module 510, the first judgment module 520, the second judgment module 530, the third judgment module 540 and the decision module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by an appropriate combination of any of them. Alternatively, at least one of the acquisition module 510, the first judgment module 520, the second judgment module 530, the third judgment module 540 and the decision module 550 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0122] Figure 6 A block diagram of an electronic device showing a database access method according to an embodiment of the present invention is shown.

[0123] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0124] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0125] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a network (LAN) card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0126] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0127] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0128] The embodiment of the present invention also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the above method provided by the embodiment of the present invention.

[0129] The computer program executes the above functions defined in the system / device of the embodiment of the present invention when it is executed by the processor 601. According to the embodiment of the present invention, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0130] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0131] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present invention are performed. According to the embodiment of the present invention, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0132] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0133] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0134] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present invention may be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments of the present invention may be combined and / or combined in various ways. All of these combinations and / or combinations fall within the scope of the present invention.

[0135] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A database access method, characterized in that: The method comprises: Acquire access request information and user information of a user for accessing a database, wherein the access request information includes access time and geographic location, and the user information includes a user role and access frequency of the user; Inputting the user role and the access time into a trained level prediction classification model to obtain a first risk level of the user; Inputting the geographical location and the access frequency into a trained fully connected neural network model to obtain a second risk level of the user; comparing the actual distance of the geographical location change from the geographical location when the user last logged in with the change distance of the preset artificially reachable geographical location, and obtaining the third risk level of the user according to the comparison result; A database access control mode for the user is determined according to the first risk level, the second risk level, and the third risk level.

2. The method according to claim 1, characterized in that The method of determining the database access control method of the user according to the first risk level, the second risk level and the third risk level includes: determining a first weight corresponding to the first risk level; determining a second weight corresponding to the second risk level; determining a third weight corresponding to the third risk level; determining a fourth risk level for the user based on a first risk level having a first weight, a second risk level having a second weight, and a third risk level having a third weight; A database access control method for the user is determined according to the fourth risk level.

3. The access method according to claim 1, characterized in that: The database access control method includes at least one of role-based access control, autonomous access control and mandatory access control.

4. The access method according to claim 1, characterized in that: Also includes: According to the data and operation type requested by the user and the rules of each access control method preset in the database to be accessed, judgments are made one by one to obtain judgment results of each access control method; If the judgment results of each access control method are all passed, the user's access request is allowed.

5. The access method according to claim 2, characterized in that: The fourth risk level includes low, medium and high.

6. The access method according to claim 5, characterized in that: According to the fourth risk level, determining the database access control method of the user includes: When the fourth risk level is low, the access method is determined to be role-based access control; When the fourth risk level is medium, the access mode is determined to be role-based access control and discretionary access control; When the fourth risk level is high, the access mode is determined to be role-based access control, discretionary access control, and mandatory access control.

7. A database access device, characterized in that: The database access device comprises: An acquisition module, used to acquire access request information and user information of a user to access a database, wherein the access request information includes access time and geographic location, and the user information includes a user role and access frequency of the user; A first judgment module, used for inputting the user role and the access time into a trained level prediction classification model to obtain a first risk level of the user; A second judgment module is used to input the geographical location and the access frequency into a trained fully connected neural network model to obtain a second risk level of the user; A third judgment module is used to compare the actual distance between the geographical location and the geographical location when the user last logged in with the change distance of the preset artificially reachable geographical location, and obtain the third risk level of the user according to the comparison result; The decision module is used to determine the database access control mode of the user according to the first risk level, the second risk level and the third risk level.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images