A data security management system based on the Internet of Things

Abstract

The present invention discloses a data security management system based on the Internet of Things, relates to the technical field of data security management, and solves the technical problems that, in data security management, only the permissions of an account are fixedly set, it is difficult to dynamically adjust the account permissions according to the situation of each login, and it is difficult to perform corresponding operation restrictions according to the dynamic permissions of the account; the present invention retrieves the basic permission factor of the user from a database based on the login account, analyzes the login information to obtain the user's permission adjustment factor one, and analyzes the basic information to obtain the user's permission adjustment factor two; summarizes the permission adjustment factor one and the permission adjustment factor two into a permission adjustment factor, adjusts the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor, and sets the user's operable behavior according to the dynamic permission factor; the present invention helps to improve the data security protection capability of the system, and also enhances the flexibility of permission management.

Description

Technical Field

[0001] The present invention belongs to the field of data protection and relates to data security management technology, specifically a data security management system based on the Internet of Things. Background Art

[0002] With the rapid development of IoT technology, more and more devices and objects are connected to the internet, forming a vast data network. These devices generate a vast amount of data of diverse types, including personal data and machine-generated data. This data contains enormous commercial value and potentially sensitive information. However, with the surge in the number of IoT devices, data security threats are also growing. Hacker attacks, malware, and data leaks caused by account anomalies are becoming frequent, posing significant security risks to businesses and individuals.

[0003] At present, most IoT-based data security management systems only set fixed account permissions in data security management, and it is difficult to dynamically adjust account permissions based on each login. If the current account is leaked, criminals can easily use the current account to perform illegal operations, posing huge security risks to enterprises and individuals. At the same time, it is difficult to impose corresponding operational restrictions based on the dynamic permissions of the account, which reduces the resistance of criminals to illegal activities and increases the risks caused by account anomalies.

[0004] Therefore, the present invention discloses a data security management system based on the Internet of Things to solve the above technical problems. Summary of the Invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a data security management system based on the Internet of Things, which is used to solve the technical problems that in data security management, the account permissions are only fixed and it is difficult to dynamically adjust the account permissions according to the situation of each login, and it is difficult to perform corresponding operation restrictions based on the dynamic permissions of the account. The present invention retrieves the user's basic permission factor from the database based on the login account, analyzes the login information to obtain the user's permission adjustment factor one, and analyzes the basic information to obtain the user's permission adjustment factor two; summarizes the permission adjustment factor one and the permission adjustment factor two into a permission adjustment factor, adjusts the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor, and solves the above problems by setting the user's operational behavior according to the dynamic permission factor.

[0006] To achieve the above-mentioned object, the first aspect of the present invention provides a data security management system based on the Internet of Things, comprising: a permission adjustment module, and a data collection module, a security management module and a database connected thereto;

[0007] The data collection module is used to obtain login account, login information and basic information; wherein the login information includes the login device identification code, login location, and login time; the basic information includes the historical permission adjustment factor and the number of super-authority clicks;

[0008] The permission adjustment module is used to retrieve the user's basic permission factor from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into a permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor;

[0009] The security management module is used to set user operable behaviors based on dynamic authority factors.

[0010] Preferably, obtaining the login account, login information and basic information includes:

[0011] Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the hardware and software information of the computer where the user platform is located;

[0012] Get the permission adjustment factor and the number of super-permission clicks for the previous n login operations of the login account; where n is manually set.

[0013] Preferably, the step of retrieving the user's basic authority factor from the database based on the login account includes:

[0014] Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

[0015] It should be noted that when an account is first created in the data management platform, the system will set different basic permission factors according to the position level of the person corresponding to the account. If the position level of a person changes, the value of the basic permission factor corresponding to the changed position level will be used to update the value of the basic permission factor set by the system during creation.

[0016] Preferably, the step of analyzing the login information to obtain the user's authority adjustment factor 1 includes:

[0017] Extract the login location of the current login account, define a range circle with the login location as the center and a set length as the radius, and mark the geographical range contained in the range circle as the target area; extract the login account's historical login locations, and obtain the number LDG of historical login locations in the target area; wherein the set length is obtained based on experience;

[0018] Get the login time of the current login account, mark the time within h time before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number LSG of historical login times in the target time range; where h is manually set;

[0019] Obtain the identification code of the login device and determine whether the identification code is an identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ1×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1=SYZ2×exp(α1×(LDG-BLDG) / BLDG+α2×(LSG-BLSG) / BLSG); wherein, the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1+α2=1, α1>α2; BLDG is the manually set number of standard historical login positions, and BLSG is the manually set number of standard historical login times.

[0020] It is worth noting that when analyzing the security of user login, the present invention first analyzes the user's geographical location and login time. This is because the geographical location can represent a person's range of activities and indirectly represent the approximate range of a person's possible logins to the data management platform; login time can reflect a person's work habits, and the time at which they are accustomed to logging into the data management platform to operate data; therefore, the present invention first analyzes the geographical location and login time, takes the user's current geographical location and login time as the target point, counts the number of geographical locations or login times within the range around the target point, and then calculates the number to obtain the correlation between the user's current geographical location and login time and the range of activities and work habits, providing data support for the subsequent acquisition of dynamic permission factors.

[0021] Preferably, the analysis of the basic information to obtain the second user authority adjustment factor includes:

[0022] Obtain the permission adjustment factor and number of over-authority clicks for successfully logging into the data management platform in the previous n login operations of the login account, classify the permission adjustment factor into Category A, and classify the over-authority clicks into Category B;

[0023] Obtain the variance corresponding to the data of categories A and B, and determine whether the variance of each category exceeds the corresponding variance setting threshold in turn; if yes, remove the data in that category that has the largest difference from the mode of that category, and re-determine the variance until the variance of that category is less than the corresponding variance setting threshold, and retain the remaining data of that category; if no, retain the data of that category;

[0024] Mark the largest value among all retained data as the maximum target value DMi, and mark the smallest value among all retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category flag, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1;

[0025] Obtain the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and obtain the permission adjustment factor QT2 based on the formula QT2 = BL × ln(δ1 × TZ1 / BTZ1 + δ2 × TZ2 / BTZ2 + 1) + 1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard number of super-authority clicks; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1 + δ2 = 1, δ1 > δ2.

[0026] It is worth noting that when obtaining the characteristic values ​​of the permission adjustment factor and the number of over-authority clicks from the previous n login operations, the present invention performs a variance test on each of these two types of data. If the variance test fails, the data with the largest fluctuation is removed and the variance test is repeated until the variance of this type of data meets the standard, retaining the remaining data. This removes the fluctuating values ​​in each type of data and produces a stable set of data, providing data support for the subsequent calculation of the characteristic values.

[0027] Preferably, the authority adjustment factor 1 and the authority adjustment factor 2 are summarized as the authority adjustment factor, including:

[0028] Extract the authority adjustment factor QT1 and the authority adjustment factor QT2, and obtain the authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

[0029] Preferably, the step of adjusting the basic authority factor based on the authority adjustment factor to obtain the dynamic authority factor includes:

[0030] Extract the authority adjustment factor QT and determine whether the value of the authority adjustment factor QT is greater than the protection threshold; if yes, update the authority adjustment factor QT using the value of the protection threshold; if no, do nothing; wherein the protection threshold is obtained through experience;

[0031] Extract the basic authority factor BQZ and obtain the dynamic authority factor DQZ based on the formula DQZ=QT×BQZ.

[0032] It is worth noting that the present invention does not set the account permissions as fixed permissions, but instead analyzes the identification code, login location, login time, historical permission adjustment factor and number of super-authority clicks of the current account's login device to obtain a dynamic permission factor, and then sets the operational behavior of the current account based on this dynamic permission factor. This can make the account permissions in a dynamic fluctuation, effectively reduce data leakage caused by account anomalies, and improve the security of the data management platform.

[0033] Preferably, the setting of operable behaviors for users based on the dynamic authority factor includes:

[0034] C1: Extract the dynamic authority factor DQZ and determine whether the dynamic authority factor DQZ is less than the operation decision threshold 1; if yes, prohibit the current account from logging in; if no, jump to C2;

[0035] C2: Determine whether the dynamic authority factor DQZ is less than the second operation decision threshold; if yes, set the current account's operable behavior to view basic data; if no, jump to C3;

[0036] C3: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold three; if yes, set the current account's operable behavior to view basic data and view core data; if no, jump to C4;

[0037] C4: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold four; if yes, set the operable behavior of the current account to view basic data, view core data and modify basic data; if no, set the operable behavior of the current account to view basic data, view core data, modify basic data and modify core data; among which, operation decision threshold one, operation decision threshold two, operation decision threshold three, operation decision threshold four and operation decision threshold five are all obtained through experience; operable behaviors include prohibiting the current account from logging in this time, viewing basic data, viewing core data, modifying basic data and modifying core data.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The present invention retrieves the user's basic authority factor from the database based on the login account, analyzes the login information to obtain the user's authority adjustment factor 1, and analyzes the basic information to obtain the user's authority adjustment factor 2; the authority adjustment factor 1 and the authority adjustment factor 2 are summarized as the authority adjustment factor, and the basic authority factor is adjusted based on the authority adjustment factor to obtain a dynamic authority factor. The user's operational behavior is set according to the dynamic authority factor, which solves the technical problems in data security management that the account's authority is only fixed and it is difficult to dynamically adjust the account's authority according to the situation of each login, and it is difficult to impose corresponding operation restrictions based on the account's dynamic authority; the present invention helps to improve the system's data security protection capabilities, and also enhances the flexibility of authority management.

[0040] 2. When analyzing the security of user login, the present invention first analyzes the user's geographic location and login time. This is because the geographic location can represent a person's range of activities and indirectly represent the approximate range of a person's possible logins to the data management platform; login time can reflect a person's work habits, and the time at which they are accustomed to logging into the data management platform to operate data; therefore, the present invention first analyzes the geographic location and login time, takes the user's current geographic location and login time as the target point, counts the number of geographic locations or login times within the range around the target point, and then calculates the number to obtain the correlation between the user's current geographic location and login time and the range of activities and work habits, providing data support for the subsequent acquisition of dynamic permission factors.

[0041] 3. The present invention does not set the account permissions as fixed permissions, but instead obtains a dynamic permission factor based on the identification code, login location, login time, historical permission adjustment factor, and number of super-authority clicks of the current account's login device. Then, the operational behavior of the current account is set based on this dynamic permission factor. This allows the account permissions to fluctuate dynamically, effectively reduces data leakage caused by account anomalies, and improves the security of the data management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 Schematic diagram of the operating steps of the present invention;

[0044] Figure 2Schematic diagram of the system module of the present invention;

[0045] Figure 3 Schematic diagram of the operation steps for obtaining the authority adjustment factor 1 of the present invention. DETAILED DESCRIPTION

[0046] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] See also Figure 1-Figure 2 , the first embodiment of the present invention provides a data security management system based on the Internet of Things, including: a permission adjustment module, and a data collection module, a security management module and a database connected thereto;

[0048] Data collection module: used to obtain login account, login information and basic information; login information includes the login device identification code, login location, and login time; basic information includes historical permission adjustment factors and the number of over-authority clicks;

[0049] Permission adjustment module: used to retrieve the user's basic permission factor from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, and analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into the permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain the dynamic permission factor;

[0050] Security management module: used to set user operational behaviors based on dynamic permission factors.

[0051] It should be noted that the number of clicks exceeding the authority limit refers to the number of clicks made by the user that exceeds the permitted range specified for this account.

[0052] For example, the specific operation steps in this embodiment are:

[0053] First, obtain the user's login account, login location, login time, and the corresponding identification code of the login computer on the data management platform;

[0054] Obtain the permission adjustment factor and the number of super-authority clicks for the first 20 login operations of the login account; wherein, in this embodiment, the value of n is 20;

[0055] Retrieve the basic permission factor set by the system when the login account is created in the data management platform;

[0056] Extract the login location of the current login account, mark the area within 100 meters around the login location as the target area, extract the historical login locations of the login account, and obtain the number of historical login locations in the target area LDG = 20; wherein, in this embodiment, the length is set to 100 meters;

[0057] Obtain the login time of the current login account, mark the time within 10 minutes before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times in the target time range LSG = 90; where, in this embodiment, the value of h is 10 minutes;

[0058] Obtain the identification code of the login device. Since the identification code is pre-stored in the database, the value of the device impact factor is set to SYZ1 = 1. Based on the formula QT1 = SYZ1 × exp(α1 × (LDG-BLDG) / BLDG + α2 × (LSG-BLSG) / BLSG) = 1 × exp(0.6 × (20-50) / 50 + 0.4 × (90-100) / 100) = 0.67, the authority adjustment factor QT1 = 0.67 is obtained. In this embodiment, the value of the proportional adjustment factor α1 is 0.6, and the value of the proportional adjustment factor α2 is 0.4; the value of the standard historical login position number BLDG is 50, and the value of the standard historical login time number BLSG is 100.

[0059] Obtain the permission adjustment factor and number of over-authority clicks for the successful login to the data management platform in the previous 20 login operations of the login account, classify the permission adjustment factor into Category A, and classify the over-authority clicks into Category B;

[0060] Obtain the variance corresponding to the data of categories A and B, and determine whether the variance of each category exceeds the corresponding variance setting threshold in turn; if yes, remove the data in that category that has the largest difference from the mode of that category, and re-determine the variance until the variance of that category is less than the corresponding variance setting threshold, and retain the remaining data of that category; if no, retain the data of that category;

[0061] The largest value among the retained data of category A is marked as the maximum target value DM1=1.6, and the smallest value among the retained data of category A is marked as the minimum target value XM1=0.9; the average value PJ1 of category A is obtained to be 1.2; based on the formula TZ1=(β1×DM1+β2×XM1+PJ1) / 2=(0.6×1.6+0.4×0.9+1.2) / 2=1.26, the characteristic value TZ1 of category A is obtained to be 1.26; wherein, in this embodiment, the value of the proportional adjustment coefficient β1 is 0.6, and the value of the proportional adjustment coefficient β2 is 0.4;

[0062] The largest value among the retained data of class B is marked as the maximum target value DM2=10, and the smallest value among the retained data of class B is marked as the minimum target value XM2=2; the average value PJ2=5 of class B is obtained; based on the formula TZ2=(β1×DM2+β2×XM2+PJ2) / 2=(0.6×10+0.4×2+5) / 2=5.9, the characteristic value TZ2=5.9 of class B is obtained;

[0063] Obtain the ratio of successful logins to the data management platform BL=0.9 in the first 20 login operations of the login account. Based on the formula QT2=BL×ln(δ1×TZ1 / BTZ1+δ2×TZ2 / BTZ2+1)+1=0.9×ln(0.7×1.26 / 1.2+0.3×5.9 / 5+1)+1=1.66, obtain the second permission adjustment factor QT2=1.66; wherein, in this embodiment, the value of the proportional adjustment coefficient δ1 is 0.8, and the value of the proportional adjustment coefficient δ1 is 0.2; the value of the Class A standard historical permission adjustment factor BTZ1 is 1.2, and the value of the Class B standard super-authority click count BTZ2 is 5;

[0064] Based on the formula QT=ρ1×QT1+ρ2×QT2=0.5×0.67+0.5×1.66=1.165, the authority adjustment factor QT=1.062 is obtained; wherein, in this embodiment, the weight factor ρ1 is 0.5, and the weight factor ρ2 is 0.5;

[0065] Because the authority adjustment factor QT = 1.165 is not greater than the protection threshold, the basic authority factor BQZ is extracted. Based on the formula DQZ = QT × BQZ = 1 × 1.165 = 1.165, the dynamic authority factor DQZ = 1.165 is obtained;

[0066] Because the dynamic permission factor DQZ=1.165, which is between the operation decision threshold 2 and the operation decision threshold 3, the operational behavior of the current account is set to view basic data and view core data.

[0067] The login account, login information, and basic information obtained in this application include:

[0068] Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the hardware and software information of the computer where the user platform is located;

[0069] Get the permission adjustment factor and the number of super-permission clicks for the previous n login operations of the login account; where n is manually set.

[0070] In this application, the user's basic permission factors are retrieved from the database based on the login account, including:

[0071] Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

[0072] It should be noted that when an account is first created in the data management platform, the system will set different basic permission factors according to the position level of the person corresponding to the account. If the position level of a person changes, the value of the basic permission factor corresponding to the changed position level will be used to update the value of the basic permission factor set by the system during creation.

[0073] See also Figure 3 In this application, the login information is analyzed to obtain the user's permission adjustment factor 1, including:

[0074] Extract the login location of the current login account, define a range circle with the login location as the center and a set length as the radius, and mark the geographical area contained in the range circle as the target area; extract the login account's historical login locations and obtain the number LDG of historical login locations in the target area; the set length is obtained based on experience;

[0075] Get the login time of the current login account, mark the time within h time before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number of historical login times in the target time range LSG; where h is manually set;

[0076] Obtain the identification code of the login device and determine whether the identification code is the identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1 = SYZ1 × exp(α1 × (LDG-BLDG) / BLDG + α2 × (LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1 = SYZ2 × exp(α1 × (LDG-BLDG) / BLDG + α2 × (LSG-BLSG) / BLSG); wherein the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1 + α2 = 1, α1 > α2; BLDG is the manually set number of standard historical login positions, and BLSG is the manually set number of standard historical login times.

[0077] In this application, basic information is analyzed to obtain the user's permission adjustment factor 2, including:

[0078] Obtain the permission adjustment factor and number of over-authority clicks for successfully logging into the data management platform in the previous n login operations of the login account, classify the permission adjustment factor into Category A, and classify the over-authority clicks into Category B;

[0079] Obtain the variance corresponding to the data of categories A and B, and determine whether the variance of each category exceeds the corresponding variance setting threshold in turn; if yes, remove the data in that category that has the largest difference from the mode of that category, and re-determine the variance until the variance of that category is less than the corresponding variance setting threshold, and retain the remaining data of that category; if no, retain the data of that category;

[0080] Mark the largest value among all retained data as the maximum target value DMi, and mark the smallest value among all retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category flag, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1;

[0081] Obtain the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and obtain the permission adjustment factor QT2 based on the formula QT2 = BL × ln(δ1 × TZ1 / BTZ1 + δ2 × TZ2 / BTZ2 + 1) + 1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard number of super-authority clicks; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1 + δ2 = 1, δ1 > δ2.

[0082] It should be noted that when obtaining the eigenvalue, the present invention does not directly use the average value for calculation, but instead comprehensively calculates the maximum value, minimum value and average value in the retained data to obtain the eigenvalue. This can make the obtained eigenvalue more representative of the stable value of the data in the retained data, and provide data support for the subsequent acquisition of the dynamic authority factor.

[0083] In this application, permission adjustment factor 1 and permission adjustment factor 2 are summarized as permission adjustment factors, including:

[0084] Extract the authority adjustment factor QT1 and the authority adjustment factor QT2, and obtain the authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

[0085] It should be noted that the authority adjustment factor designed in the present invention is used to dynamically adjust the authority of different accounts.

[0086] In this application, the basic permission factor is adjusted based on the permission adjustment factor to obtain a dynamic permission factor, including:

[0087] Extract the permission adjustment factor QT and determine whether the value of the permission adjustment factor QT is greater than the protection threshold. If yes, update the permission adjustment factor QT using the value of the protection threshold. If no, do nothing. The protection threshold is obtained through experience.

[0088] Extract the basic authority factor BQZ and obtain the dynamic authority factor DQZ based on the formula DQZ=QT×BQZ.

[0089] In this application, the user's operational behavior is set based on the dynamic permission factor, including:

[0090] C1: Extract the dynamic permission factor DQZ and determine whether the dynamic permission factor DQZ is less than the operation decision threshold 1; if so, prohibit the current account from logging in; if not, jump to C2;

[0091] C2: Determine whether the dynamic permission factor DQZ is less than the second operation decision threshold; if yes, set the current account's operability to view basic data; if no, jump to C3;

[0092] C3: Determine whether the dynamic permission factor DQZ is less than the operation decision threshold three. If yes, set the current account's operational behavior to view basic data and view core data. If no, jump to C4.

[0093] C4: Determine whether the dynamic permission factor DQZ is less than the operation decision threshold four; if yes, set the current account's operable behaviors to view basic data, view core data, and modify basic data; if no, set the current account's operable behaviors to view basic data, view core data, modify basic data, and modify core data; among them, operation decision threshold one, operation decision threshold two, operation decision threshold three, operation decision threshold four, and operation decision threshold five are all obtained through experience; operable behaviors include prohibiting the current account from logging in this time, being able to view basic data, being able to view core data, being able to modify basic data, and being able to modify core data.

[0094] Some of the data in the above formula are calculated by removing the dimensions and taking their numerical values. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0095] Working principle of the present invention:

[0096] The present invention first obtains a login account, login information, and basic information; then, based on the login account, retrieves the user's basic authority factor from a database, analyzes the login information to obtain the user's authority adjustment factor one, and obtains the correlation between the user's current geographic location and login time and the scope of activity and work habits, providing data support for the subsequent acquisition of a dynamic authority factor; analyzes the basic information to obtain the user's authority adjustment factor two; summarizes the authority adjustment factor one and the authority adjustment factor two as a authority adjustment factor, and adjusts the basic authority factor based on the authority adjustment factor to obtain a dynamic authority factor; this can make the account's authority in a dynamic fluctuation, and can effectively reduce the data leakage caused by account anomalies; finally, the user's operable behavior is set according to the dynamic authority factor.

[0097] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A data security management system based on the Internet of Things, characterized in that: include: Permission adjustment module, and its connected data collection module, security management module and database; The data collection module is used to obtain login account, login information and basic information; wherein the login information includes the login device identification code, login location, and login time; the basic information includes the historical permission adjustment factor and the number of super-authority clicks; The permission adjustment module is used to retrieve the user's basic permission factor from the database based on the login account, analyze the login information to obtain the user's permission adjustment factor 1, analyze the basic information to obtain the user's permission adjustment factor 2; summarize the permission adjustment factor 1 and the permission adjustment factor 2 into a permission adjustment factor, and adjust the basic permission factor based on the permission adjustment factor to obtain a dynamic permission factor; The security management module is used to set user operable behaviors based on dynamic authority factors.

2. A data security management system based on the Internet of Things according to claim 1, characterized in that: The acquisition of login account, login information and basic information includes: Obtain the user's login account, login location, login time for the data management platform, and generate a unique identification code for the current computer based on the hardware and software information of the computer where the user platform is located; Get the permission adjustment factor and number of super-permission clicks for the last n login operations of the login account.

3. The data security management system based on the Internet of Things according to claim 1, characterized in that: The method of retrieving the user's basic authority factor from the database based on the login account includes: Retrieve the basic permission factor set by the system when the login account is created in the data management platform.

4. The data security management system based on the Internet of Things according to claim 1, characterized in that: The analysis of the login information to obtain the user's authority adjustment factor 1 includes: Extract the login location of the login account for this login, use the login location as the center and set the length as the radius to delineate a range circle, and mark the geographical range contained in the range circle as the target area; extract the login account's historical login locations, and obtain the number LDG of historical login locations in the target area; Get the login time of the login account, mark the time within h before and after the login time as the target time range, extract the historical login time of the login account, and obtain the number LSG of historical login times in the target time range; Obtain the identification code of the login device and determine whether the identification code is an identification code pre-stored in the database; if yes, set the value of the device impact factor to SYZ1, and obtain the authority adjustment factor QT1 based on the formula QT1 = SYZ1 × exp(α1 × (LDG-BLDG) / BLDG + α2 × (LSG-BLSG) / BLSG); if no, set the value of the device impact factor to SYZ2, and obtain the authority adjustment factor QT1 based on the formula QT1 = SYZ2 × exp(α1 × (LDG-BLDG) / BLDG + α2 × (LSG-BLSG) / BLSG); wherein, the value of SYZ1 is greater than SYZ2, α1 and α2 are both proportional adjustment factors greater than 0, and α1 + α2 = 1, α1 > α2; BLDG is the number of standard historical login positions, and BLSG is the number of standard historical login times.

5. The data security management system based on the Internet of Things according to claim 4 is characterized in that: The analysis of the basic information to obtain the second user authority adjustment factor includes: Obtain the permission adjustment factor and number of over-authority clicks for successfully logging into the data management platform in the previous n login operations of the login account, classify the permission adjustment factor into Category A, and classify the over-authority clicks into Category B; Obtain the variance corresponding to the data of categories A and B, and determine whether the variance of each category exceeds the corresponding variance setting threshold in turn; if yes, remove the data in that category that has the largest difference from the mode of that category, and re-determine the variance until the variance of that category is less than the corresponding variance setting threshold, and retain the remaining data of that category; if no, retain the data of that category; Mark the largest value among all retained data as the maximum target value DMi, and mark the smallest value among all retained data as the minimum target value XMi; obtain the average value PJi of each category; obtain the characteristic value TZi of each category based on the formula TZi=(β1×DMi+β2×XMi+PJi) / 2; where i is the category flag, when i is 1, it indicates category A, and when i is 2, it indicates category B; β1 and β2 are both proportional adjustment coefficients greater than 0, and β1+β2=1; Obtain the ratio BL of successful logins to the data management platform in the previous n login operations of the login account, and obtain the permission adjustment factor QT2 based on the formula QT2 = BL × ln(δ1 × TZ1 / BTZ1 + δ2 × TZ2 / BTZ2 + 1) + 1; wherein BTZ1 is the Class A standard historical permission adjustment factor, and BTZ2 is the standard number of super-authority clicks; δ1 and δ2 are both proportional adjustment coefficients greater than 0, and δ1 + δ2 = 1, δ1 > δ2.

6. The data security management system based on the Internet of Things according to claim 5, characterized in that: The permission adjustment factor 1 and the permission adjustment factor 2 are summarized as the permission adjustment factor, including: Extract the authority adjustment factor QT1 and the authority adjustment factor QT2, and obtain the authority adjustment factor QT based on the formula QT=ρ1×QT1+ρ2×QT2; wherein ρ1 and ρ2 are weight factors both greater than 0.

7. The data security management system based on the Internet of Things according to claim 6, characterized in that: The step of adjusting the basic authority factor based on the authority adjustment factor to obtain the dynamic authority factor includes: Extract the authority adjustment factor QT and determine whether the value of the authority adjustment factor QT is greater than the protection threshold; if yes, update the authority adjustment factor QT using the value of the protection threshold; if no, do nothing; Extract the basic authority factor BQZ and obtain the dynamic authority factor DQZ based on the formula DQZ=QT×BQZ.

8. The data security management system based on the Internet of Things according to claim 7, characterized in that: The setting of operable behaviors for users based on dynamic authority factors includes: C1: Extract the dynamic authority factor DQZ and determine whether the dynamic authority factor DQZ is less than the operation decision threshold 1; if yes, prohibit the current account from logging in; if no, jump to C2; C2: Determine whether the dynamic authority factor DQZ is less than the second operation decision threshold; if yes, set the current account's operable behavior to view basic data; if no, jump to C3; C3: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold three; if yes, set the current account's operable behavior to view basic data and view core data; if no, jump to C4; C4: Determine whether the dynamic authority factor DQZ is less than the operation decision threshold four; if yes, set the operable behavior of the current account to view basic data, view core data and modify basic data; if no, set the operable behavior of the current account to view basic data, view core data, modify basic data and modify core data; wherein, the operable behavior includes prohibiting the current account from logging in this time, viewing basic data, viewing core data, modifying basic data and modifying core data.

Images