Data security management system based on Internet of Things

Abstract

The invention discloses a data security management system based on the Internet of Things, relates to the technical field of data security management, and solves the problems that in data security management, only the permission of an account is fixedly set, the account permission is difficult to dynamically adjust according to the condition of login each time, and the data security management efficiency is improved. And corresponding operation limitation is difficult to carry out according to the dynamic permission of the account. The method comprises the following steps: calling a basic authority factor of a user from a database based on a login account, analyzing login information to obtain a first authority adjustment factor of the user, and analyzing basic information to obtain a second authority adjustment factor of the user; summarizing the permission regulation factor I and the permission regulation factor II into permission regulation factors, regulating the basic permission factor based on the permission regulation factors to obtain a dynamic permission factor, and setting operable behaviors of the user according to the dynamic permission factor; according to the invention, the data security protection capability of the system can be improved, and the flexibility of authority management is enhanced at the same time.

Description

Technical Field

[0001] The present invention belongs to the field of data protection, relates to data security management technology, and specifically is a data security management system based on the Internet of Things. Background Art

[0002] With the rapid development of IoT technology, more and more devices and objects are connected to the Internet, forming a huge data network. The amount of data generated by these devices is huge and diverse, including personal data, machine-generated data, etc., which contain huge commercial value and potential sensitive information. However, with the surge in the number of IoT devices, data security threats are also growing. Hacker attacks, malware, data leaks caused by account anomalies and other incidents occur frequently, bringing huge security risks to enterprises and individuals.

[0003] At present, most IoT-based data security management systems only set fixed account permissions in data security management, and it is difficult to dynamically adjust account permissions based on each login situation. If the current account is leaked, lawbreakers can easily perform illegal operations based on the current account, posing huge security risks to enterprises and individuals. At the same time, it is difficult to impose corresponding operational restrictions based on the dynamic permissions of the account, which reduces the resistance of lawbreakers and increases the risks caused by account anomalies.

[0004] Therefore, the present invention discloses a data security management system based on the Internet of Things to solve the above technical problems. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a data security management system based on the Internet of Things, which is used to solve the technical problems that in data security management, only the permissions of an account are fixedly set, it is difficult to dynamically adjust the account permissions according to the situation of each login, and it is difficult to perform corresponding operation restrictions based on the dynamic permissions of the account. The present invention retrieves the user's basic permission factor from the database based on the login account, analyzes the login information to obtain the user's permission adjustment factor one, and analyzes the basic information to obtain the user's permission adjustment factor two; summarizes the permission adjustment factor one and the permission adjustment factor two into a permission adjustment factor, adjusts the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor, and sets the user's operable behavior according to the dynamic permission factor to solve the above problems.

[0006] To achieve the above-mentioned object, the first aspect of the present invention provides a data security management system based on the Internet of Things, comprising: a permission adjustment module, and a data collection module, a security management module and a database connected thereto;

[0007] The data collection module is used to obtain the login account, login information and basic information; wherein the login information includes the identification code of the login device, the login location, and the login time; the basic information includes the historical authority adjustment factor and the number of super-authority clicks;

[0008] The permission adjustment module is used to retrieve the basic permission factor of the user from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into a permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor;

[0009] The security management module is used to set operable behaviors for users according to dynamic authority factors.

[0010] Preferably, the obtaining of the login account, login information and basic information includes:

[0011] Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the computer hardware and software information where the user platform is located;

[0012] Get the permission adjustment factor and the number of super-permission clicks for the previous n login operations of the login account; where n is obtained through manual setting.

[0013] Preferably, retrieving the user's basic authority factor from the database based on the login account includes:

[0014] Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

[0015] It should be noted that when an account is created for the first time in the data management platform, the system will set different basic permission factors according to the position level of the person corresponding to the account. If the position level of a certain person changes, the value of the basic permission factor corresponding to the changed position level will be used to update the value of the basic permission factor set by the system during creation.

[0016] Preferably, the step of analyzing the login information to obtain the user's authority adjustment factor 1 includes:

[0017] Extract the login location of the login account for this login, use the login location as the center and set a length as the radius to delineate a range circle, and mark the geographical range contained in the range circle as the target area; extract the historical login locations of the login account, and obtain the number LDG of historical login locations in the target area; wherein the set length is obtained through experience;

[0018] Get the login time of the login account this time, mark the time within h time before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times LSG in the target time range; where h is obtained by manual setting;

[0019] Obtain the identification code of the login device, and determine whether the identification code is the identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ1×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ2×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); wherein, the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1+α2=1, α1>α2; BLDG is the number of standard historical login positions set manually, and BLSG is the number of standard historical login times set manually.

[0020] It is worth noting that when analyzing the security of user login, the present invention first analyzes based on the user's geographical location and login time. Because the geographical location can represent a person's range of activities, and indirectly represents the approximate range of a person's possible login to the data management platform; the login time can reflect a person's work habits, and the time at which he or she is accustomed to log in to the data management platform to operate the data; therefore, the present invention first analyzes the geographical location and login time, takes the user's current geographical location and login time as the target point, counts the number of geographical locations or login times within the range around the target point, and then calculates the number to obtain the correlation between the user's current geographical location and login time and the range of activities and work habits, which provides data support for the subsequent acquisition of dynamic permission factors.

[0021] Preferably, the step of analyzing the basic information to obtain the second permission adjustment factor of the user includes:

[0022] Obtain the authority adjustment factor and the number of super-authority clicks that successfully logged into the data management platform in the previous n login operations of the login account, and classify the authority adjustment factor into Category A and the number of super-authority clicks into Category B;

[0023] Get the variances corresponding to the data of categories A and B, and judge whether the variances of each category exceed the corresponding variance setting threshold in turn; if yes, remove the data with the largest difference from the mode of this category, and re-judge the variance until the variance of this category is less than the corresponding variance setting threshold, and retain the remaining data of this category; if no, retain the data of this category;

[0024] Mark the largest value in each category of retained data as the maximum target value DMi, and mark the smallest value in each category of retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category mark, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1;

[0025] Get the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and get the permission adjustment factor QT2 based on the formula QT2=BL×ln(δ1×TZ1 / BTZ1+δ2×TZ2 / BTZ2+1)+1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard super-authority click count; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1+δ2=1, δ1>δ2.

[0026] It is worth noting that when obtaining the characteristic values ​​of the authority adjustment factor and the number of super-authority clicks in the previous n login operations, the present invention makes a variance judgment on these two types of data respectively. When the variance judgment fails, the value with the largest fluctuation in this type of data is removed and the variance judgment is made again until the variance of this type of data meets the standard and the remaining data is retained. In this way, the fluctuation influence values ​​in various types of data can be removed to obtain a number of stable data, which provides data support for the subsequent calculation of characteristic values.

[0027] Preferably, the step of summarizing the authority adjustment factor 1 and the authority adjustment factor 2 as the authority adjustment factor includes:

[0028] Extract authority adjustment factor 1 QT1 and authority adjustment factor 2 QT2, and obtain authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

[0029] Preferably, the step of adjusting the basic authority factor based on the authority adjustment factor to obtain the dynamic authority factor includes:

[0030] Extract the authority adjustment factor QT, and determine whether the value of the authority adjustment factor QT is greater than the protection threshold; if yes, update the authority adjustment factor QT using the value of the protection threshold; if no, do nothing; wherein the protection threshold is obtained through experience;

[0031] The basic authority factor BQZ is extracted, and the dynamic authority factor DQZ is obtained based on the formula DQZ=QT×BQZ.

[0032] It is worth noting that the present invention does not set the account permissions as fixed permissions, but rather obtains a dynamic permission factor based on the identification code of the current account's login device, login location, login time, historical permission adjustment factors, and number of super-permission clicks, and then sets the operational behavior of the current account based on this dynamic permission factor. This allows the account permissions to be in a dynamic fluctuation, effectively reduces data leakage caused by account anomalies, and improves the security of the data management platform.

[0033] Preferably, the setting of operable behaviors for users according to the dynamic authority factor includes:

[0034] C1: extract the dynamic authority factor DQZ, and determine whether the dynamic authority factor DQZ is less than the operation decision threshold 1; if yes, prohibit the current account from logging in; if no, jump to C2;

[0035] C2: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 2; if yes, set the operable behavior of the current account to be able to view basic data; if no, jump to C3;

[0036] C3: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 3; if yes, set the operable behavior of the current account to view basic data and view core data; if no, jump to C4;

[0037] C4: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold four; if yes, set the operable behaviors of the current account to be able to view basic data, view core data and modify basic data; if no, set the operable behaviors of the current account to be able to view basic data, view core data, modify basic data and modify core data; wherein, the operation decision threshold one, the operation decision threshold two, the operation decision threshold three, the operation decision threshold four and the operation decision threshold five are all obtained through experience; the operable behaviors include prohibiting the current account from logging in this time, being able to view basic data, being able to view core data, being able to modify basic data and being able to modify core data.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The present invention retrieves the user's basic authority factor from the database based on the login account, analyzes the login information to obtain the user's authority adjustment factor 1, and analyzes the basic information to obtain the user's authority adjustment factor 2; the authority adjustment factor 1 and the authority adjustment factor 2 are summarized as the authority adjustment factor, and the basic authority factor is adjusted based on the authority adjustment factor to obtain a dynamic authority factor, and the user's operable behavior is set according to the dynamic authority factor, which solves the technical problems that in data security management, the account's authority is only fixed, it is difficult to dynamically adjust the account's authority according to each login situation, and it is difficult to perform corresponding operation restrictions according to the account's dynamic authority; the present invention helps to improve the system's data security protection capabilities, and also enhances the flexibility of authority management.

[0040] 2. When analyzing the security of user login, the present invention first analyzes based on the user's geographical location and login time. Because the geographical location can represent a person's range of activities, and indirectly represents the approximate range of a person's possible login to the data management platform; the login time can reflect a person's work habits, and the time at which he or she is accustomed to log in to the data management platform to operate the data; therefore, the present invention first analyzes the geographical location and login time, takes the user's current geographical location and login time as the target point, counts the number of geographical locations or login times within the range around the target point, and then calculates the number to obtain the correlation between the user's current geographical location and login time and the range of activities and work habits, providing data support for the subsequent acquisition of dynamic authority factors.

[0041] 3. The present invention does not set the account permissions as fixed permissions, but instead obtains a dynamic permission factor based on the identification code, login location, login time, historical permission adjustment factor, and number of super-permission clicks of the current account's login device, and then sets the operational behavior of the current account based on this dynamic permission factor. This allows the account permissions to be in a dynamic fluctuation, effectively reduces data leakage caused by account anomalies, and improves the security of the data management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a schematic diagram of the operation steps of the present invention;

[0044] Figure 2It is a schematic diagram of the system module of the present invention;

[0045] Figure 3 Schematic diagram of the operation steps for obtaining the authority adjustment factor 1 of the present invention. DETAILED DESCRIPTION

[0046] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] See also Figure 1-Figure 2 , the first aspect of the present invention provides a data security management system based on the Internet of Things, including: a permission adjustment module, and a data collection module, a security management module and a database connected thereto;

[0048] Data collection module: used to obtain login account, login information and basic information; the login information includes the login device identification code, login location, login time; the basic information includes the historical permission adjustment factor and the number of super-permission clicks;

[0049] Permission adjustment module: used to retrieve the user's basic permission factor from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, and analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into the permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain the dynamic permission factor;

[0050] Security management module: used to set operational behaviors for users based on dynamic permission factors.

[0051] It should be noted that the number of clicks beyond authority refers to the number of clicks by the user that exceed the usable range specified for this account.

[0052] Exemplarily, the specific operation steps in this embodiment are:

[0053] First, obtain the user's login account, login location, login time, and the identification code corresponding to the login computer of the data management platform;

[0054] Obtain the authority adjustment factor and the number of super-authority clicks for the previous 20 login operations of the login account; wherein, in this embodiment, the value of n is 20;

[0055] Retrieve the basic permission factor set by the system when the login account is created in the data management platform;

[0056] Extract the login location of the login account this time, mark the range within 100m around the login location as the target area, extract the historical login locations of the login account, and obtain the number of historical login locations LDG=20 in the target area; wherein, in this embodiment, the length value is set to 100m;

[0057] Get the login time of the login account, mark the time within 10 minutes before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times LSG=90 in the target time range; wherein, in this embodiment, the value of h is 10 minutes;

[0058] The identification code of the login device is obtained, because the identification code is the identification code pre-stored in the database; therefore, the value of the device impact factor is set to SYZ1=1, and based on the formula QT1=SYZ1×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG)=1×exp(0.6×(20-50) / 50+0.4×(90-100) / 100)=0.67, the authority adjustment factor QT1=0.67 is obtained; wherein, in this embodiment, the value of the proportional adjustment factor α1 is 0.6, and the value of the proportional adjustment factor α2 is 0.4; the value of the standard historical login position number BLDG is 50, and the value of the standard historical login time number BLSG is 100;

[0059] Obtain the authority adjustment factor and the number of over-authority clicks that successfully logged into the data management platform in the previous 20 login operations of the login account, and classify the authority adjustment factor into Category A and the number of over-authority clicks into Category B;

[0060] Get the variances corresponding to the data of categories A and B, and judge whether the variances of each category exceed the corresponding variance setting threshold in turn; if yes, remove the data with the largest difference from the mode of this category, and re-judge the variance until the variance of this category is less than the corresponding variance setting threshold, and retain the remaining data of this category; if no, retain the data of this category;

[0061] The largest value in the data retained by class A is marked as the maximum target value DM1=1.6, and the smallest value in the data retained by class A is marked as the minimum target value XM1=0.9; the average value PJ1=1.2 of class A is obtained; based on the formula TZ1=(β1×DM1+β2×XM1+PJ1) / 2=(0.6×1.6+0.4×0.9+1.2) / 2=1.26, the characteristic value TZ1=1.26 of class A is obtained; wherein, in this embodiment, the value of the proportional adjustment coefficient β1 is 0.6, and the value of the proportional adjustment coefficient β2 is 0.4;

[0062] Mark the largest value in the data retained by class B as the maximum target value DM2=10, and mark the smallest value in the data retained by class B as the minimum target value XM2=2; obtain the average value PJ2=5 of class B; based on the formula TZ2=(β1×DM2+β2×XM2+PJ2) / 2=(0.6×10+0.4×2+5) / 2=5.9, obtain the characteristic value TZ2=5.9 of class B;

[0063] The ratio of successful logins to the data management platform in the first 20 login operations of the login account is obtained as BL=0.9, and based on the formula QT2=BL×ln(δ1×TZ1 / BTZ1+δ2×TZ2 / BTZ2+1)+1=0.9×ln(0.7×1.26 / 1.2+0.3×5.9 / 5+1)+1=1.66, the authority adjustment factor 2 QT2=1.66 is obtained; wherein, in this embodiment, the value of the proportional adjustment coefficient δ1 is 0.8, and the value of the proportional adjustment coefficient δ1 is 0.2; the value of the class A standard historical authority adjustment factor BTZ1 is 1.2, and the value of the class B standard super-authority click count BTZ2 is 5;

[0064] Based on the formula QT=ρ1×QT1+ρ2×QT2=0.5×0.67+0.5×1.66=1.165, the authority adjustment factor QT=1.062 is obtained; wherein, in this embodiment, the weight factor ρ1 is taken as 0.5, and the weight factor ρ2 is taken as 0.5;

[0065] Since the authority adjustment factor QT=1.165 is not greater than the protection threshold, the basic authority factor BQZ is extracted, and based on the formula DQZ=QT×BQZ=1×1.165=1.165, the dynamic authority factor DQZ=1.165 is obtained;

[0066] Because the dynamic authority factor DQZ=1.165, which is between the operation decision threshold 2 and the operation decision threshold 3, the operable behavior of the current account is set to view basic data and view core data.

[0067] The login account, login information and basic information obtained in this application include:

[0068] Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the computer hardware and software information where the user platform is located;

[0069] Get the permission adjustment factor and the number of super-permission clicks for the previous n login operations of the login account; where n is obtained through manual setting.

[0070] In this application, the user's basic permission factors are retrieved from the database based on the login account, including:

[0071] Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

[0072] It should be noted that when an account is created for the first time in the data management platform, the system will set different basic permission factors according to the position level of the person corresponding to the account. If the position level of a certain person changes, the value of the basic permission factor corresponding to the changed position level will be used to update the value of the basic permission factor set by the system during creation.

[0073] See also Figure 3 In this application, the login information is analyzed to obtain the user's permission adjustment factor 1, including:

[0074] Extract the login location of the login account for this login, use the login location as the center and set the length as the radius to delineate a range circle, and mark the geographical range contained in the range circle as the target area; extract the historical login locations of the login account, and obtain the number LDG of historical login locations in the target area; the set length is obtained through experience;

[0075] Get the login time of the login account, mark the time within h time before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times LSG in the target time range; where h is obtained by manual setting;

[0076] Obtain the identification code of the login device, and determine whether the identification code is the identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ1×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ2×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); wherein, the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1+α2=1, α1>α2; BLDG is the number of standard historical login positions set manually, and BLSG is the number of standard historical login times set manually.

[0077] In this application, the basic information is analyzed to obtain the user's permission adjustment factor 2, including:

[0078] Obtain the authority adjustment factor and the number of super-authority clicks that successfully logged into the data management platform in the previous n login operations of the login account, and classify the authority adjustment factor into Category A and the number of super-authority clicks into Category B;

[0079] Get the variances corresponding to the data of categories A and B, and judge whether the variances of each category exceed the corresponding variance setting threshold in turn; if yes, remove the data with the largest difference from the mode of this category, and re-judge the variance until the variance of this category is less than the corresponding variance setting threshold, and retain the remaining data of this category; if no, retain the data of this category;

[0080] Mark the largest value in each category of retained data as the maximum target value DMi, and mark the smallest value in each category of retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category mark, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1;

[0081] Get the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and get the permission adjustment factor QT2 based on the formula QT2=BL×ln(δ1×TZ1 / BTZ1+δ2×TZ2 / BTZ2+1)+1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard super-authority click count; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1+δ2=1, δ1>δ2.

[0082] It should be noted that when obtaining the eigenvalue, the present invention does not directly use the average value for calculation, but instead comprehensively calculates the maximum value, minimum value and average value in the retained data to obtain the eigenvalue. This can make the obtained eigenvalue more representative of the stable value of the data in the retained data, and provide data support for the subsequent acquisition of the dynamic authority factor.

[0083] In this application, the permission adjustment factor 1 and the permission adjustment factor 2 are summarized as the permission adjustment factor, including:

[0084] Extract authority adjustment factor 1 QT1 and authority adjustment factor 2 QT2, and obtain authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

[0085] It should be noted that the authority adjustment factor designed in the present invention is used to dynamically adjust the authority of different accounts.

[0086] In this application, the basic permission factor is adjusted based on the permission adjustment factor to obtain a dynamic permission factor, including:

[0087] Extract the permission adjustment factor QT and determine whether the value of the permission adjustment factor QT is greater than the protection threshold; if yes, use the value of the protection threshold to update the permission adjustment factor QT; if no, do nothing; the protection threshold is obtained through experience;

[0088] The basic authority factor BQZ is extracted, and the dynamic authority factor DQZ is obtained based on the formula DQZ=QT×BQZ.

[0089] In this application, the user's operable behaviors are set according to the dynamic permission factors, including:

[0090] C1: Extract the dynamic authority factor DQZ and determine whether the dynamic authority factor DQZ is less than the operation decision threshold 1; if yes, prohibit the current account from logging in; if no, jump to C2;

[0091] C2: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 2; if yes, set the operable behavior of the current account to view basic data; if no, jump to C3;

[0092] C3: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 3; if yes, set the operable behavior of the current account to view basic data and view core data; if no, jump to C4;

[0093] C4: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold four; if yes, set the operable behaviors of the current account to view basic data, view core data and modify basic data; if no, set the operable behaviors of the current account to view basic data, view core data, modify basic data and modify core data; among which, operation decision threshold one, operation decision threshold two, operation decision threshold three, operation decision threshold four and operation decision threshold five are all obtained through experience; the operable behaviors include prohibiting the current account from logging in this time, viewing basic data, viewing core data, modifying basic data and modifying core data.

[0094] Part of the data in the above formula is calculated by removing the dimension and taking its numerical value. The formula is a formula closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0095] Working principle of the present invention:

[0096] The present invention first obtains a login account, login information and basic information; then retrieves the user's basic authority factor from a database based on the login account, analyzes the login information to obtain the user's authority adjustment factor 1, obtains the correlation between the user's current geographical location and login time and the activity range and work habits, and provides data support for the subsequent acquisition of a dynamic authority factor; analyzes the basic information to obtain the user's authority adjustment factor 2; summarizes the authority adjustment factor 1 and the authority adjustment factor 2 as an authority adjustment factor, and adjusts the basic authority factor based on the authority adjustment factor to obtain a dynamic authority factor; in this way, the account's authority is in a dynamic fluctuation, which can effectively reduce the data leakage caused by account anomalies; finally, the user's operable behavior is set according to the dynamic authority factor.

[0097] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A data security management system based on the Internet of Things, characterized in that: include: The authority adjustment module, and the data collection module, security management module and database connected thereto; The data collection module is used to obtain the login account, login information and basic information; wherein the login information includes the identification code of the login device, the login location, and the login time; the basic information includes the historical authority adjustment factor and the number of super-authority clicks; The permission adjustment module is used to retrieve the basic permission factor of the user from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into a permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor; The security management module is used to set operable behaviors for users according to dynamic authority factors.

2. According to the data security management system based on the Internet of Things according to claim 1, it is characterized in that: The obtaining of login account, login information and basic information includes: Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the computer hardware and software information where the user platform is located; Get the permission adjustment factor and number of super-permission clicks for the previous n login operations of the login account.

3. According to the data security management system based on the Internet of Things in claim 1, it is characterized in that: The method of retrieving the user's basic authority factor from the database based on the login account includes: Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

4. According to the data security management system based on the Internet of Things in claim 1, it is characterized in that: The analysis of the login information to obtain the user's authority adjustment factor 1 includes: Extract the login location of the login account for this login, use the login location as the center, set the length as the radius to delineate a range circle, and mark the geographical range contained in the range circle as the target area; extract the historical login locations of the login account, and obtain the number LDG of historical login locations in the target area; Get the login time of the login account this time, mark the time within h time before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times LSG in the target time range; Obtain the identification code of the login device, and determine whether the identification code is the identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ1×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ2×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); wherein, the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1+α2=1, α1>α2; BLDG is the number of standard historical login positions, and BLSG is the number of standard historical login times.

5. The data security management system based on the Internet of Things according to claim 4 is characterized in that: The second permission adjustment factor of the user obtained by analyzing the basic information includes: Obtain the authority adjustment factor and the number of super-authority clicks that successfully logged into the data management platform in the previous n login operations of the login account, and classify the authority adjustment factor into Category A and the number of super-authority clicks into Category B; Get the variances corresponding to the data of categories A and B, and judge whether the variances of each category exceed the corresponding variance setting threshold in turn; if yes, remove the data with the largest difference from the mode of this category, and re-judge the variance until the variance of this category is less than the corresponding variance setting threshold, and retain the remaining data of this category; if no, retain the data of this category; Mark the largest value in each category of retained data as the maximum target value DMi, and mark the smallest value in each category of retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category mark, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1; Get the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and get the permission adjustment factor QT2 based on the formula QT2=BL×ln(δ1×TZ1 / BTZ1+δ2×TZ2 / BTZ2+1)+1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard super-authority click count; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1+δ2=1, δ1>δ2.

6. A data security management system based on the Internet of Things according to claim 5, characterized in that: The permission adjustment factor 1 and the permission adjustment factor 2 are summarized as the permission adjustment factor, including: Extract authority adjustment factor 1 QT1 and authority adjustment factor 2 QT2, and obtain authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

7. A data security management system based on the Internet of Things according to claim 6, characterized in that: The step of adjusting the basic authority factor based on the authority adjustment factor to obtain the dynamic authority factor includes: Extract the authority adjustment factor QT, and determine whether the value of the authority adjustment factor QT is greater than the protection threshold; if yes, update the authority adjustment factor QT using the value of the protection threshold; if no, do nothing; The basic authority factor BQZ is extracted, and the dynamic authority factor DQZ is obtained based on the formula DQZ=QT×BQZ.

8. The data security management system based on the Internet of Things according to claim 7 is characterized in that: The setting of operable behaviors for users according to the dynamic authority factor includes: C1: extract the dynamic authority factor DQZ, and determine whether the dynamic authority factor DQZ is less than the operation decision threshold 1; if yes, prohibit the current account from logging in; if no, jump to C2; C2: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 2; if yes, set the operable behavior of the current account to be able to view basic data; if no, jump to C3; C3: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold 3; if yes, set the operable behavior of the current account to view basic data and view core data; if no, jump to C4; C4: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold four; if yes, set the operable behaviors of the current account to view basic data, view core data and modify basic data; if no, set the operable behaviors of the current account to view basic data, view core data, modify basic data and modify core data; wherein the operable behaviors include prohibiting the current account from logging in this time, viewing basic data, viewing core data, modifying basic data and modifying core data.

Images