Data security management method, system and device for cloud computing software

Abstract

The invention provides a data security management method, system and device for cloud computing software. The method comprises the following steps: determining historical access information of target data; determining an abnormal access feature through the historical access information, further determining an authorization risk coefficient of each data block in the target data, and determining a security deviation index of each cloud computing user under current authorization in the cloud computing software; determining authorization credibility, and further determining an authorization response value of each cloud computing user in the cloud computing software according to all the authorization credibility; determining authorization verification information of each data block in the target data; and then determining the security level of each data block under the current authorization, and performing access authorization limitation on each cloud computing user in the cloud computing software through all security levels. According to the scheme, partition access authorization can be performed on each cloud computing software user based on the access authorization limitation, so that the authorization security of the target data in the cloud computing software can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing software, and more specifically, to a data security management method, system and device for cloud computing software. Background Art

[0002] Data security management of cloud computing software refers to ensuring the confidentiality, integrity and availability of data during storage, transmission and processing in a cloud computing environment through a series of technologies and strategies. With the widespread application of cloud computing, data security management has become an important part of protecting user data and maintaining system credibility. In a cloud computing environment, multiple users usually share the same computing resources and data storage space. However, with the widespread application of cloud computing services, data security and access control have become critical issues.

[0003] In a cloud computing sharing environment, it is difficult to accurately authorize different cloud computing users to access the same data resources. Some users may abuse their authorization rights and access data that is irrelevant to their duties or needs, which may allow some users to have excessive access rights in specific circumstances, thereby increasing the risk of data leakage, especially in the face of malicious users or internal threats, further exacerbating security risks. The above problems can be effectively solved by partitioning access authorization for each cloud computing software user, thereby improving the authorization security of network data in cloud computing software. Therefore, how to implement partitioned access authorization for each cloud computing software user to improve the authorization security of network data in cloud computing software is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a data security management method, system and device for cloud computing software, which can realize partition access authorization for each cloud computing software user, thereby improving the authorization security of network data in cloud computing software.

[0005] In a first aspect, the present application provides a data security management method for cloud computing software, comprising the following steps: Obtaining access records of target data by various cloud computing users using cloud computing software through computing servers in a cloud computing cluster, thereby obtaining historical access information of the target data, wherein the target data includes a plurality of data blocks; Determine the abnormal access characteristics of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access characteristic, and then determine the security deviation index of each cloud computing user under the current authorization in the cloud computing software through the historical access information and all the authorization risk coefficients; Collect the risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all authorization credibility; Determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all dynamic access decisions; The security level of each data block under the current authorization is determined according to the authorization response value and each authorization verification information, and authorization access restrictions are performed on each cloud computing user in the cloud computing software through all security levels.

[0006] In some embodiments, determining the authorization risk coefficient of each data block in the target data according to each abnormal access feature specifically includes: For each data block in the target data, obtaining abnormal access records of each cloud computing user to the data block; Obtain the abnormal features of each abnormal access record in each abnormal question feature; The authorization risk coefficient of the data block is determined according to all abnormal features, and then the authorization risk coefficient of each data block in the target data is obtained.

[0007] In some embodiments, determining the security deviation index of each cloud computing user under current authorization in the cloud computing software based on the historical access information and all authorization risk coefficients specifically includes: For each cloud computing user in the cloud computing software, obtaining the access frequency of each data block by the cloud computing user from the historical access information; Determine the authorization risk amount of each data block by the access frequency of each data block and the authorization risk coefficient of the corresponding data block; The security deviation index of the cloud computing user under the current authorization is determined according to all the authorized risk quantities, and then the security deviation index of each cloud computing user under the current authorization in the cloud computing software is obtained.

[0008] In some embodiments, determining the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all the safety deviation indexes specifically includes: For each data block in the target data, obtain the authorization risk amount of the data block to each cloud computing user from all security deviation indexes; Determine the risk attribute frequency value of the risk attribute of each cloud computing user; Determine the authorization trust value of the data block for each cloud computing user through each authorization risk amount and the corresponding risk attribute frequency value; The authorization credibility of the data block is determined according to all the authorization credibility values, and then the authorization credibility of each data block in the target data is obtained.

[0009] In some embodiments, determining the authorization response value of each cloud computing user in the cloud computing software from all authorization credibility specifically includes: For each cloud computing user in the cloud computing software, all access data blocks of the cloud computing user are obtained; Determine the authorization credibility of each access data block; The authorization response value of the cloud computing user is determined through all the authorization credibility, and then the authorization response value of each cloud computing user in the cloud computing software is obtained.

[0010] In some embodiments, determining the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes specifically includes: For each authorization state, obtain the security deviation index of each cloud computing user in the authorization state; Determine the risk entropy of each data block in the authorized state through all security deviation indices; The data security of the authorization status is determined according to all risk entropies and the extraction request, and then the dynamic access decision of each cloud computing user under the current authorization is obtained.

[0011] In some embodiments, determining the authorization verification information of each data block in the target data based on the historical access information and all dynamic access decisions specifically includes: For each data block in the target data, filtering the authorization data of the data block in the historical access information; Obtaining, from the authorization data, an authorization response value of the data block to each cloud computing user as the data block authorization level; Obtain the data security value of the data block at the authorization level from all dynamic access decisions; Filtering all trusted authorization records from the authorization data by using various data security values; The authorization verification information of the data block is determined according to all the trusted authorization records, and then the authorization verification information of each data block in the target data is obtained.

[0012] In a second aspect, the present application provides a data security management system for cloud computing software, including: An acquisition module, used to acquire access records of target data by various cloud computing users using cloud computing software through computing servers in a cloud computing cluster, thereby obtaining historical access information of the target data, wherein the target data includes a plurality of data blocks; a processing module, configured to determine abnormal access features of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access feature, and further determine the security deviation index of each cloud computing user under the current authorization in the cloud computing software through the historical access information and all the authorization risk coefficients; The processing module is further used to collect risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all the authorization credibility; The processing module is further used to determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all dynamic access decisions; The execution module is used to determine the security level of each data block under the current authorization according to the authorization response value and each authorization verification information, and to perform authorization access restrictions on each cloud computing user in the cloud computing software through all security levels.

[0013] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned data security management method for cloud computing software.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data security management method of the above-mentioned cloud computing software is implemented.

[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: The data security management method, system and device of cloud computing software provided by the present application first obtain the access records of each cloud computing user using the cloud computing software to the target data through the computing server in the cloud computing cluster, and then obtain the historical access information of the target data, wherein the target data includes multiple data blocks; then, the abnormal access characteristics of each cloud computing user are determined through the historical access information, and the authorization risk coefficient of each data block in the target data is determined according to each abnormal access characteristic, and then the security deviation index of each cloud computing user under the current authorization in the cloud computing software is determined according to the historical access information and all the authorization risk coefficients; thirdly, the risk attributes of each cloud computing user are collected, and the risk attributes corresponding to each risk attribute are determined according to the risk factors. The authorization credibility of each data block in the target data is determined based on the risk attribute frequency value and all the security deviation indexes, and then the authorization response value of each cloud computing user in the cloud computing software is determined based on all the authorization credibility; then, the extraction request of each cloud computing user for the target data is determined, and the dynamic access decision of each cloud computing user under the current authorization is determined based on the extraction request and all the security deviation indexes, and then the authorization verification information of each data block in the target data is determined based on the historical access information and all the dynamic access decisions; finally, the security level of each data block under the current authorization is determined based on the authorization response value and each authorization verification information, and the authorized access restrictions are performed on each cloud computing user in the cloud computing software through all the security levels.

[0016] It can be seen that in this application, the security level of each data block under the current authorization is determined according to each authorization verification information, and the access authorization restrictions are imposed on each cloud computing user in the cloud computing software through all security levels to complete the data protection of the target data in the cloud computing software; first, the security deviation index of each cloud computing user under the current authorization is determined according to the historical access information and the authorization risk coefficient. The security deviation index quantifies the overall risk level of the user. Through accurate security deviation index evaluation, the cloud computing software can dynamically adjust the access rights of the cloud computing user, thereby reducing security risks; then, the authorization credibility of each data block in the target data is calculated according to the risk attribute frequency value and the security deviation index. The authorization credibility reflects the security reliability and risk exposure level of each data block under the current authorization conditions. The evaluation of authorization credibility not only improves the dynamic access decision-making ability, but also ensures that key data blocks are more effectively protected. The authorization credibility of all data blocks determines the authorization response value of each cloud computing user in the cloud computing software. The determination of the authorization status enables the system to dynamically adjust the user's access rights to ensure that high-risk users cannot access sensitive data under certain conditions. Through the dynamic management mechanism, the cloud computing software effectively reduces the possibility of data leakage and improves the overall dynamic access decision. Finally, the system further analyzes the overall dynamic access decision of each data block through security deviation index evaluation and authorization status determination. The determination of dynamic access decisions helps the system identify data blocks that need to be protected, and generates authorization verification information based on this. Through precise authorization verification information management, not only the security of data in cloud computing software is improved, but also the transparency and controllability of authorization management are enhanced. In summary, based on the above scheme, partitioned access authorization can be implemented for each cloud computing software user, thereby improving the authorization security of target data in cloud computing software. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is an exemplary flow chart of a data security management method for cloud computing software according to some embodiments of the present application; Figure 2 is an exemplary flow chart of determining abnormal access characteristics of each cloud computing user according to some embodiments of the present application; Figure 3 is a schematic diagram of an exemplary process of determining the authorization credibility of each data block in the target data according to some embodiments of the present application; Figure 4 is a schematic diagram of the structure of a data security management system for cloud computing software according to some embodiments of the present application; Figure 5 It is a structural diagram of a computer device for implementing a data security management method for cloud computing software according to some embodiments of the present application. DETAILED DESCRIPTION

[0018] The core of the present application is to obtain the access records of each cloud computing user using the cloud computing software to the target data through the computing server in the cloud computing cluster, and then obtain the historical access information of the target data, wherein the target data includes multiple data blocks; determine the abnormal access characteristics of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access characteristic, and then determine the security deviation index of each cloud computing user in the cloud computing software under the current authorization according to the historical access information and all the authorization risk coefficients; collect the risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all the security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all the authorization credibility; determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all the security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all the dynamic access decisions; determine the security level of each data block under the current authorization according to the authorization response value and each authorization verification information, and restrict the authorized access of each cloud computing user in the cloud computing software according to all the security levels. The above scheme is based on access authorization restrictions, and can implement partitioned access authorization for each cloud computing software user, thereby improving the authorization security of target data in the cloud computing software.

[0019] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 , which is an exemplary flow chart of a data security management method for cloud computing software according to some embodiments of the present application. The data security management method 100 for cloud computing software mainly includes the following steps: In step 101, access records of target data by various cloud computing users using cloud computing software are obtained through computing servers in a cloud computing cluster, thereby obtaining historical access information of the target data, where the target data includes multiple data blocks.

[0020] In the specific implementation, in the cloud computing cluster, the computing server is configured with a log recording module to record in real time each user's access request to the target data, including time, access user, accessed data block and other information. Then, the collected access records are sorted and analyzed to form historical access information of each data block, including statistical information such as the number of accesses, time intervals, and access users. The target data is then divided into multiple data blocks, which are classified according to the nature, importance or access frequency of the data to ensure that the information of each data block is independent and easy to manage. Finally, the access records of each cloud computing user to the target data within a preset time period (the default is the most recent 1 year) in the cloud computing software are obtained, and the collection of all access records can be used as the historical access information of the target data.

[0021] It should be noted that the historical access information in this application refers to a data set of access records of data by each cloud computing user in the cloud computing software. The access record refers to the access process record of each cloud computing user to the data. An access record contains multiple access process records of a cloud computing user. Each access process record includes authorization data, access user, access target and access identifier. The authorization data refers to the access authorization level of each data block in the target data to the cloud computing user.

[0022] In step 102, the abnormal access characteristics of each cloud computing user are determined through the historical access information, and the authorization risk coefficient of each data block in the target data is determined according to each abnormal access characteristic. Then, the security deviation index of each cloud computing user under the current authorization in the cloud computing software is determined based on the historical access information and all the authorization risk coefficients.

[0023] In some embodiments, reference Figure 2 As shown, this figure is an exemplary flow chart of determining abnormal access characteristics of each cloud computing user according to some embodiments of the present application. In this embodiment, determining the abnormal access characteristics of each cloud computing user through the historical access information can be implemented by the following steps: In step 1021, for each cloud computing user, the access record of the cloud computing user is obtained from the historical access information; In step 1022, an abnormal access identifier in the cloud computing software is obtained; In step 1023, abnormal access data of the cloud computing user is extracted from the access record according to the abnormal access identifier; In step 1024, abnormal access features of cloud computing users are determined through the abnormal access data, and then the abnormal access features of each cloud computing user are obtained.

[0024] In the specific implementation, first, for each cloud computing user, the access record of the cloud computing user is obtained from the historical access information; secondly, the abnormal access identifier can be obtained in the record description file of the cloud computing software, for example, the access identifier greater than 5 can be used as the abnormal access identifier; then, for each access process record in the access record, the access process record with the access identifier as the abnormal access identifier in the access process record is used as the abnormal access record. All abnormal access records can be obtained in the above manner, and the set of all abnormal access records can be used as the abnormal access data of the cloud computing user; finally, the existing feature extraction algorithm can be used to extract the set of abnormal features of each abnormal access record in the abnormal access data as the abnormal access feature of the cloud computing user. The abnormal access feature of each cloud computing user can be obtained in the above manner.

[0025] It should be noted that in this application, abnormal access identification refers to the characteristics or signals that are detected by analyzing the historical access information of cloud computing users, which are significantly deviated from the normal access behavior pattern. These deviations usually include abnormal access frequency, abnormal access time, unauthorized data block access, abnormal geographic location or device, and other operations that are inconsistent with expected authorized behavior; abnormal access data refers to access records that are significantly inconsistent with normal access behavior. These data may include frequent access attempts, unauthorized data access, abnormal access time periods, or access from unusual geographic locations; abnormal access feature representation.

[0026] In some embodiments, determining the authorization risk coefficient of each data block in the target data according to each abnormal access feature can be implemented by the following steps: For each data block in the target data, obtaining abnormal access records of each cloud computing user to the data block; Obtain the abnormal features of each abnormal access record in each abnormal question feature; The authorization risk coefficient of the data block is determined according to all abnormal features, and then the authorization risk coefficient of each data block in the target data is obtained.

[0027] In the specific implementation, first, for each data block in the target data, obtain the abnormal access records of each cloud computing user to the data block; secondly, obtain the abnormal features of each abnormal access record in each abnormal question feature; finally, initialize a risk assessment model (for example: risk matrix), use all abnormal features as evaluation parameters of the risk assessment model, use the data block as the evaluation object of the risk assessment model, use the risk assessment model to complete the risk assessment of the data block, and the risk assessment result can be used as the authorization risk coefficient of the data block. The authorization risk coefficient of each data block in the target data can be obtained in the above manner. It should be noted that the risk assessment result of the risk assessment model is the complexity of the security risk faced by the data block in the current environment.

[0028] It should be noted that the authorization risk coefficient in this application reflects the complexity of the security risks faced by each data block in the current environment; abnormal features are features used to identify potential security threats; and abnormal access records are used to identify and store access behavior records that may pose a threat to system security.

[0029] In some embodiments, determining the security deviation index of each cloud computing user under current authorization in the cloud computing software based on the historical access information and all authorization risk coefficients can be implemented by the following steps: For each cloud computing user in the cloud computing software, obtaining the access frequency of each data block by the cloud computing user from the historical access information; Determine the authorization risk amount of each data block by the access frequency of each data block and the authorization risk coefficient of the corresponding data block; The security deviation index of the cloud computing user under the current authorization is determined according to all the authorized risk quantities, and then the security deviation index of each cloud computing user under the current authorization in the cloud computing software is obtained.

[0030] In the specific implementation, first, for each cloud computing user in the cloud computing software, the number of visits to each data block by the cloud computing user in the historical access information is counted, and the number of visits of each user divided by the number of days in the preset time period can be used as the access frequency of the corresponding data block; then, the product of the access frequency of each data block and the authorization risk coefficient of the corresponding data block can be used as the authorization risk amount of each data block. The higher the access frequency and the more complex the authorization risk coefficient of the data block, the higher the authorization risk amount of the data block; finally, the set of all authorization risk amounts can be used as the value range of the security deviation index of the cloud computing user under the current authorization, and the security deviation index of the cloud computing user under the current authorization can be obtained. The determination of the security deviation index provides a comprehensive risk assessment tool for the system, so that the system can implement corresponding access control strategies for cloud computing users with different risk levels, and the hierarchical management ensures the security and stability of the system under different risk conditions.

[0031] It should be noted that the access frequency in this application refers to the number of times a cloud computing user accesses a specific data block within a certain time range. The access frequency reflects the user's active access to the data block, and is usually measured by the number of accesses within a time unit (such as hours, days or months); the authorization risk amount refers to an indicator quantified by analyzing the access frequency of the data block and its corresponding authorization risk coefficient, reflecting the potential security risk level of a specific data block under the current authorization conditions; the security deviation index refers to a quantitative indicator that measures the degree of deviation between the actual access behavior of a cloud computing user and his normal authorized behavior under the current authorization conditions. The index is determined by analyzing the user's authorization risk amount (such as abnormal access characteristics, access frequency, access time, etc.) and is used to evaluate the security of user behavior.

[0032] In step 103, the risk attributes of each cloud computing user are collected, and the authorization credibility of each data block in the target data is determined according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then the authorization response value of each cloud computing user in the cloud computing software is determined according to all the authorization credibility.

[0033] It should be noted that, in the present application, risk attributes are comprehensive characteristics that reflect the security risks that users may face in a cloud computing environment. Risk attributes include information such as the user's historical behavior patterns, past security incidents, the user's role and permissions, and the security policies of the user's organization. In specific implementation, the risk attributes of each cloud computing user can be obtained in the cloud computing software. Obtaining and analyzing the risk attributes enables the cloud computing software to conduct a more detailed assessment of the security risks of cloud computing users. By understanding the risk attributes of each user, the cloud computing software can better predict and respond to potential security threats, thereby optimizing access control strategies and improving the overall data protection level of the cloud computing software.

[0034] In some embodiments, reference Figure 3 As shown, the figure is an exemplary flow chart of determining the authorization credibility of each data block in the target data according to some embodiments of the present application. In this embodiment, the authorization credibility of each data block in the target data is determined according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, which can be implemented by the following steps: In step 1031, for each data block in the target data, the authorization risk amount of the data block to each cloud computing user is obtained from all security deviation indexes; In step 1032, the risk attribute frequency value of the risk attribute of each cloud computing user is determined; In step 1033, the authorization trust value of the data block for each cloud computing user is determined by each authorization risk amount and the corresponding risk attribute frequency value; In step 1034, the authorization credibility of the data block is determined according to all the authorization credibility values, and then the authorization credibility of each data block in the target data is obtained.

[0035] In the specific implementation, first, for each data block in the target data, the authorized risk amount of the data block to each cloud computing user is obtained from all security deviation indices; secondly, the risk attribute frequency value of the risk attribute of each cloud computing user can be obtained in the cloud computing software. The calculation of the risk attribute frequency value can effectively evaluate the distribution and uncertainty of the user's risk attribute. High information entropy indicates that the risk attribute is more complex, that is, more protection measures are needed to improve the accuracy of risk assessment; then, the product of each authorized risk amount and the corresponding risk attribute frequency value can be used as the authorized trust value of the data block to each cloud computing user. The calculation of the authorized trust value enables the cloud computing software to perform accurate security assessment on the data access of each user, thereby ensuring that the user's access control to the data block under different risk conditions can be effectively managed; finally, the mode of all authorized trust values ​​can be used as the authorized trustworthiness of the data block. The authorized trustworthiness of each data block in the target data can be obtained in the above manner.

[0036] It should be noted that the authorization risk amount in this application represents a measure of the comprehensive security risk faced by a specific data block when accessed by different users, reflecting the potential risk level of the data block under different access conditions; the risk attribute frequency value represents the number of times or proportions of occurrences of a specific risk attribute (such as the number of abnormal logins, the frequency of accessing high-risk data blocks, etc.) within a certain time range, and is used to quantify the activity level or performance frequency of the user's specific risk attribute; the authorization trust value represents an indicator of the authorization reliability and security of a specific data block for each cloud computing user, and the authorization trustworthiness represents the overall security trustworthiness of the data block under the current authorization. The calculated authorization trustworthiness provides a comprehensive security assessment result for the data block, enabling the cloud computing software to adjust access rights according to the trustworthiness level; the authorization trustworthiness is a measure of the reliability of secure access to the data block by each cloud computing user under the current authorization.

[0037] In some embodiments, determining the authorization response value of each cloud computing user in the cloud computing software from all authorization credibility can be implemented by the following steps: For each cloud computing user in the cloud computing software, all access data blocks of the cloud computing user are obtained; Determine the authorization credibility of each access data block; The authorization response value of the cloud computing user is determined through all the authorization credibility, and then the authorization response value of each cloud computing user in the cloud computing software is obtained.

[0038] In the specific implementation, first, all access data blocks of cloud computing users are obtained; then, for each access data block, the authorization credibility of the access data block is screened out from all the authorization credibility, and the authorization credibility of each access data block can be obtained in the above manner. Finally, the mean of all authorization credibility is compared with the preset authorization level interval, and the authorization level interval corresponding to each authorization credibility is used as the authorization level of the corresponding authorization credibility. The set of authorization levels of each authorization credibility can be used as the authorization response value of the cloud computing user. The authorization response value of each cloud computing user in the cloud computing software can be obtained in the above manner, wherein the authorization status interval refers to the mapping relationship between the authorization credibility and the authorization status, which can be preset through historical experience combined with the degree of protection of data security by the cloud computing software.

[0039] It should be noted that the authorization response value in this application represents an indicator obtained based on a comprehensive evaluation of the authorization credibility of each data block, reflecting the security and credibility of access to the target data by a specific cloud computing user under the current authorization conditions.

[0040] In step 104, the extraction request of each cloud computing user for the target data is determined, and the dynamic access decision of each cloud computing user under the current authorization is determined based on the extraction request and all security deviation indices, and then the authorization verification information of each data block in the target data is determined based on the historical access information and all dynamic access decisions.

[0041] In specific implementation, determining the extraction request of each cloud computing user for the target data can be implemented in the following manner, namely: first, setting an interface for cloud computing users to submit extraction requests for the target data. The request should include user identity information, requested data block identifier, requested operation type (such as read, download) and requested timestamp. Then, after receiving the extraction request, the system first verifies the identity and authority of the user, checks the user's authorization response value, and ensures that the user has the authority to access the requested data block. Then, each valid extraction request is recorded in the log, including information such as request time, user ID, data block ID, request type and response status. Finally, according to the operation type requested by the user, the corresponding data processing module is called. If it is a read request, the system will obtain the data block from the storage and return it to the user; if it is a download request, the data will be packaged and a download link will be provided, that is, the extraction request of each cloud computing user for the target data is obtained. In other embodiments, other methods can also be used to determine the extraction request of each cloud computing user for the target data, which is not limited here.

[0042] It should be noted that, in the present application, the extraction request of each cloud computing user for target data represents an access or operation request issued by the cloud computing user for specific target data, aiming to obtain or download information of a specific data block.

[0043] In some embodiments, determining the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indices can be implemented by the following steps: For each authorization state, obtain the security deviation index of each cloud computing user in the authorization state; Determine the risk entropy of each data block in the authorized state through all security deviation indices; The data security of the authorization status is determined according to all risk entropies and the extraction request, and then the dynamic access decision of each cloud computing user under the current authorization is obtained.

[0044] In the specific implementation, first, for each authorization state, all cloud computing users in the authorization state are screened in the cloud computing software, and then the security deviation index of each screened cloud computing user is obtained; then, for each data block, the access risk value of each cloud computing user to the data block is extracted from the security deviation index, and the average of all access risk values ​​can be used as the access risk of the data block. The access risk of each data block can be obtained in the above manner, and the information entropy of each access risk can be calculated using the existing information entropy algorithm as the risk entropy of the corresponding data block in the authorization state; finally, the absolute value of the difference between each risk entropy and 1 can be used as the data security value of the corresponding data block in the authorization state, and the set of all data security values ​​and the number of extraction requests can be input into the risk assessment model, and the model will output the result as the dynamic access decision of the cloud computing user under the current authorization. The dynamic access decision of each cloud computing user under the current authorization can be obtained in the above manner, which includes the impact of the evaluation request on the risk entropy and the feedback on the security deviation index.

[0045] It should be noted that the risk entropy of each data block in this application represents a quantitative indicator for evaluating the risk uncertainty faced by each data block under a specific authorization state; the dynamic access decision is used to evaluate the response speed of the data's protection capabilities and risk resistance capabilities under the current authorization state. A faster dynamic access decision indicates that the data is relatively safe under the current authorization and is suitable for user access; while a slower data security indicates the need to strengthen security measures or restrict access rights to reduce risks.

[0046] In some embodiments, determining the authorization verification information of each data block in the target data from the historical access information and all dynamic access decisions can be implemented by the following steps: For each data block in the target data, filtering the authorization data of the data block in the historical access information; Obtaining, from the authorization data, an authorization response value of the data block to each cloud computing user as the data block authorization level; Obtain the data security value of the data block at the authorization level from all dynamic access decisions; Filtering all trusted authorization records from the authorization data by using various data security values; The authorization verification information of the data block is determined according to all the trusted authorization records, and then the authorization verification information of each data block in the target data is obtained.

[0047] In the specific implementation, first, in the historical access information, for each data block, the authorization data related to its access is extracted, including the user's access permission record, operation type, and access time; then, from the filtered authorization data, the authorization response value of each data block to each cloud computing user is extracted, and these values ​​reflect the access security of the user under the current authorization state; then, from all dynamic access decisions, the security value at its authorization level is obtained for each data block, and the security value measures the security of the data block under the current authorization conditions; again, by comparing the security values ​​of each data block, all trusted authorization records are filtered out from the authorization data, that is, the data in the authorization records within the security value range; finally, based on all the filtered trusted authorization records, the authorization verification information of the data block is comprehensively evaluated to ensure the verification of the legitimacy of the user's access request, that is, the authorization verification information of each data block in the target data is obtained. In other embodiments, other methods can also be used to determine the authorization verification information of each data block in the target data, which is not limited here.

[0048] It should be noted that the data block authorization level in this application represents the grade or score assigned to the access rights and security assessment of each data block under a specific authorization state; the data security value represents the security index assessed for a certain data block under a specific authorization state, reflecting the potential risk and security level of the data block under the current access conditions; the trusted authorization record represents the authorized access record that is considered safe and compliant when evaluating the access rights to the data block, ensuring that only access records verified as reliable under specific conditions are included; the authorization verification information represents the relevant information used to verify the cloud computing user's access rights to a specific data block. This information is usually based on the user's authorization status, trusted authorization record and security assessment results to ensure that the user has the necessary authority when requesting access to data.

[0049] In step 105, the security level of each data block under the current authorization is determined according to the authorization response value and each authorization verification information, and authorization access restrictions are performed on each cloud computing user in the cloud computing software through all security levels.

[0050] In some embodiments, determining the security level of each data block under the current authorization according to the authorization response value and each authorization verification information can be implemented by the following steps: For each data block, obtain the authorization information of the data block in the historical access information; Determine risk authorization information through the authorization information and authorization verification information of the data block; Determine the risk fluctuation entropy of the data block at each authorization level in the risk authorization information; The security level of the data block under the current authorization is determined according to all risk fluctuation entropies and the authorization response value, and then the security level of each data block under the current authorization is obtained.

[0051] In the specific implementation, first, the authorization information related to each data block is extracted from the historical access information, including access permission records, user identity, access frequency and authorization status, etc. This information can be collected by querying the database or data warehouse; then, the risk authorization information of each data block is evaluated in combination with the extracted authorization information and the corresponding authorization verification information, which involves comparing the authorization information with the user's access history to identify potential risk points; then, based on the risk authorization information, the risk fluctuation entropy of the data block at each authorization level is calculated. The risk fluctuation entropy can be calculated by the information entropy formula (such as Shannon entropy) to reflect the fluctuation of risk at different authorization levels; finally, based on the risk fluctuation entropy of all data blocks and the corresponding authorization response values, a weighted or normalized method is used to calculate the security level of each data block under the current authorization. This process can use a mathematical model or algorithm to combine various indicators to obtain the final security level, which will not be repeated here.

[0052] It should be noted that the risk authorization information in this application refers to the risk-related authorization information that is comprehensively considered when evaluating the user's access rights to a specific data block, including the user's authorization status, access history, authorization response value, and various indicators related to the security of the data block; the risk fluctuation entropy represents a quantitative indicator of the uncertainty of data block risk under a specific authorization level, reflecting the fluctuation of risk under different authorization conditions; the security level represents an indicator of the security level of each data block under the current authorization conditions, which is used to evaluate the overall risk level of the data block and guide permission management and access control decisions.

[0053] In specific implementation, the following methods can be used to restrict the authorized access of each cloud computing user in the cloud computing software through all security levels, namely: first, extract the security level of all data blocks to ensure that the latest security assessment results of each data block are available, which can be obtained through database query or data interface; then, define the threshold of the security level according to business needs and security policies. For example, a minimum security level can be set, and data blocks below this score will be subject to access restrictions; then, evaluate the access request of each cloud computing user to check whether the security level of the requested data block is higher than the set threshold; finally, dynamically adjust the user's access rights according to the security level and the user's request, and deny the user's access request for the data block with a security level lower than the threshold, and record the reason, record the results of all access requests (allowed or denied) in the log, and provide feedback to the user to explain the processing result and reason of the request, that is, complete the data protection of the target data in the cloud computing software, which will not be repeated here.

[0054] In addition, in another aspect of the present application, in some embodiments, the present application provides a data security management system for cloud computing software, referring to Figure 4 , which is a schematic diagram of the structure of a data security management system for cloud computing software according to some embodiments of the present application. The data security management system 400 of the cloud computing software includes: an acquisition module 401, a processing module 402 and an execution module 403, which are described as follows: Acquisition module 401, in this application, acquisition module 401 is mainly used to acquire access records of target data by various cloud computing users using cloud computing software through computing servers in the cloud computing cluster, and then obtain historical access information of the target data, wherein the target data includes multiple data blocks; Processing module 402, in the present application, is mainly used to determine the abnormal access characteristics of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access characteristic, and then determine the security deviation index of each cloud computing user under the current authorization in the cloud computing software according to the historical access information and all the authorization risk coefficients; The processing module 402 is further used to collect risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all authorization credibility; The processing module 402 is further used to determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all dynamic access decisions; Execution module 403, in this application, execution module 403 is mainly used to determine the security level of each data block under the current authorization according to the authorization response value and each authorization verification information, and to perform authorized access restrictions on each cloud computing user in the cloud computing software through all security levels.

[0055] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores code, and the processor is configured to obtain the code and execute the above-mentioned data security management method for cloud computing software.

[0056] In some embodiments, reference Figure 5 , which is a schematic diagram of the structure of a computer device for implementing a data security management method for cloud computing software according to some embodiments of the present application. The data security management method for cloud computing software in the above embodiment can be Figure 5 The computer device 500 shown in the figure is implemented, and the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503 and at least one communication interface 504.

[0057] Processor 501 can be a general-purpose central processing unit (CPU), or an application specific integrated circuit (ASIC) or one or more for controlling the execution of the data security management method of the cloud computing software in this application.

[0058] The communication bus 502 may be used to transmit information between the above-mentioned components.

[0059] The memory 503 may be a read only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read only memory (EEPROM), a compact disc read only memory (CD ROM) or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 503 may exist independently and be connected to the processor 501 via the communication bus 502. The memory 503 may also be integrated with the processor 501.

[0060] The memory 503 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 501. The processor 501 is used to execute the program code stored in the memory 503. The program code may include one or more software modules. The data security management method of the cloud computing software in the above embodiment can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0061] The communication interface 504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0062] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-core (single CPU) processor or a multi-core (multi CPU) processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0063] The above-mentioned computer device may be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device.

[0064] In addition, the present application also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, it implements the data security management method of the above-mentioned cloud computing software.

[0065] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0066] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data security management method for cloud computing software, characterized in that: The steps include: Obtaining access records of target data by various cloud computing users using cloud computing software through computing servers in a cloud computing cluster, thereby obtaining historical access information of the target data, wherein the target data includes a plurality of data blocks; Determine the abnormal access characteristics of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access characteristic, and then determine the security deviation index of each cloud computing user under the current authorization in the cloud computing software through the historical access information and all the authorization risk coefficients; Collect the risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all authorization credibility; Determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all dynamic access decisions; The security level of each data block under the current authorization is determined according to the authorization response value and each authorization verification information, and authorization access restrictions are performed on each cloud computing user in the cloud computing software through all security levels.

2. The method according to claim 1, characterized in that Determining the authorization risk coefficient of each data block in the target data according to each abnormal access feature specifically includes: For each data block in the target data, obtaining abnormal access records of each cloud computing user to the data block; Obtain the abnormal feature of each abnormal access record in each abnormal question feature; The authorization risk coefficient of the data block is determined according to all abnormal features, and then the authorization risk coefficient of each data block in the target data is obtained.

3. The method according to claim 1, characterized in that Determining the security deviation index of each cloud computing user under current authorization in the cloud computing software based on the historical access information and all authorization risk coefficients specifically includes: For each cloud computing user in the cloud computing software, obtaining the access frequency of the cloud computing user to each data block from the historical access information; Determine the authorization risk amount of each data block by the access frequency of each data block and the authorization risk coefficient of the corresponding data block; The security deviation index of the cloud computing user under the current authorization is determined according to all the authorized risk quantities, and then the security deviation index of each cloud computing user under the current authorization in the cloud computing software is obtained.

4. The method according to claim 1, characterized in that The authorization credibility of each data block in the target data is determined according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, including: For each data block in the target data, obtain the authorization risk amount of the data block to each cloud computing user from all security deviation indexes; Determine the risk attribute frequency value of the risk attribute of each cloud computing user; Determine the authorization trust value of the data block for each cloud computing user through each authorization risk amount and the corresponding risk attribute frequency value; The authorization credibility of the data block is determined according to all the authorization credibility values, and then the authorization credibility of each data block in the target data is obtained.

5. The method according to claim 1, characterized in that The authorization response values ​​of each cloud computing user in the cloud computing software are determined by all authorization credibility, including: For each cloud computing user in the cloud computing software, all access data blocks of the cloud computing user are obtained; Determine the authorization credibility of each access data block; The authorization response value of the cloud computing user is determined through all the authorization credibility, and then the authorization response value of each cloud computing user in the cloud computing software is obtained.

6. The method according to claim 1, characterized in that Determining the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes specifically includes: For each authorization state, obtain the security deviation index of each cloud computing user in the authorization state; Determine the risk entropy of each data block in the authorized state through all security deviation indices; The data security of the authorization status is determined according to all risk entropies and the extraction request, and then the dynamic access decision of each cloud computing user under the current authorization is obtained.

7. The method according to claim 1, characterized in that The authorization verification information of each data block in the target data is determined by the historical access information and all dynamic access decisions, specifically including: For each data block in the target data, filtering the authorization data of the data block in the historical access information; Obtaining, from the authorization data, an authorization response value of the data block to each cloud computing user as the data block authorization level; Obtain the data security value of the data block at the authorization level from all dynamic access decisions; Filtering all trusted authorization records from the authorization data by using various data security values; The authorization verification information of the data block is determined according to all the trusted authorization records, and then the authorization verification information of each data block in the target data is obtained.

8. A data security management system for cloud computing software, characterized in that: include: An acquisition module, used to acquire access records of target data by various cloud computing users using cloud computing software through computing servers in a cloud computing cluster, thereby obtaining historical access information of the target data, wherein the target data includes a plurality of data blocks; a processing module, configured to determine abnormal access features of each cloud computing user through the historical access information, determine the authorization risk coefficient of each data block in the target data according to each abnormal access feature, and further determine the security deviation index of each cloud computing user under the current authorization in the cloud computing software through the historical access information and all the authorization risk coefficients; The processing module is further used to collect risk attributes of each cloud computing user, determine the authorization credibility of each data block in the target data according to the risk attribute frequency value corresponding to each risk attribute and all security deviation indexes, and then determine the authorization response value of each cloud computing user in the cloud computing software according to all the authorization credibility; The processing module is further used to determine the extraction request of each cloud computing user for the target data, determine the dynamic access decision of each cloud computing user under the current authorization according to the extraction request and all security deviation indexes, and then determine the authorization verification information of each data block in the target data according to the historical access information and all dynamic access decisions; The execution module is used to determine the security level of each data block under the current authorization according to the authorization response value and each authorization verification information, and to perform authorization access restrictions on each cloud computing user in the cloud computing software through all security levels.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores codes, and the processor is configured to obtain the codes and execute the data security management method for cloud computing software according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data security management method for cloud computing software according to any one of claims 1 to 7 is implemented.

Images