Information security management method and system for enterprise customers

Abstract

The invention discloses an information security management method and system for enterprise customers, and relates to the technical field of information security, and the method comprises the steps: collecting equipment identification information data and operation behavior data, carrying out the security scoring of the equipment identification information data and the operation behavior data through a security baseline model, generating a security level, and dividing a security control region. An access permission and a data encryption strategy are configured; establishing a dynamic session channel for data transmission of the security control area, and performing key updating according to a preset time period; and monitoring data transmission characteristics of the dynamic session channel, triggering multi-factor identity authentication, and recording an audit log. According to the method, an accurate quantitative evaluation mechanism of equipment and user behaviors is established through the security baseline model, and comprehensive perception of security risks is realized; the differentiated management and control region division based on the security level enables the security resource configuration to be finer and more intelligent; and the multi-factor identity authentication and the audit log record cooperate with each other, so that the reliability of identity authentication is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security management method and system for enterprise customers. Background Art

[0002] Traditional information security management models mainly rely on static access control and single-dimensional security assessments, which are difficult to cope with increasingly complex network security threats. In recent years, academia and industry have continued to explore more intelligent and dynamic security management paradigms, and are committed to building a security defense system that can perceive in real time and respond quickly. Emerging security technologies such as zero-trust architecture, behavioral analysis, and multi-factor authentication have gradually become important pillars of enterprise information security protection, providing a more advanced technical path for building all-round, multi-level security defense.

[0003] Existing enterprise information security management technologies have many limitations. First, traditional security management solutions often lack a comprehensive and refined evaluation mechanism for devices and user behaviors. Security policy formulation relies on experience and static rules and cannot effectively respond to dynamically changing security risks. Secondly, existing technologies still rely on single or limited authentication methods for identity authentication, and it is difficult to balance security and user experience. Furthermore, data transmission security management lacks flexible dynamic adjustment capabilities and cannot quickly adjust access rights and encryption policies based on real-time risk conditions. These technical shortcomings have led to continuous information security challenges for enterprises, and a more intelligent, proactive, and refined security management method is urgently needed.

[0004] In view of the problems of existing enterprise information security technology, such as inaccurate security assessment, untimely risk prevention and control, and single authentication mechanism, this paper proposes an information security management method and system for enterprise customers, which focuses on solving key problems of enterprises in equipment management, access control and data transmission security, and improves the intelligence and dynamism of enterprise information security management. Summary of the invention

[0005] In view of the problems of inaccurate security assessment, untimely risk prevention and control, and single authentication mechanism in the existing enterprise information security management technology, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is how to achieve comprehensive security assessment of enterprise equipment and user behavior, flexible access control, efficient data encryption transmission and multi-dimensional identity authentication, so as to effectively improve the enterprise information security defense capabilities and risk management level.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides an information security management method for enterprise customers.

[0009] It includes collecting device identification information data and operation behavior data of enterprise customers, scoring the device identification information data and operation behavior data through a security baseline model, and generating a security level; dividing the security control area according to the security level, and configuring access rights and data encryption policies; establishing a dynamic session channel for data transmission in the security control area, and updating the key according to a preset time period; monitoring the data transmission characteristics of the dynamic session channel, and triggering multi-factor identity authentication, and recording audit logs, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

[0010] As a preferred solution of the information security management method for enterprise customers described in the present invention, the triggering method of the multi-factor identity authentication is to deploy a data transmission monitoring module in the dynamic session channel to collect data transmission characteristics in real time, wherein the data transmission characteristics include the amount of data transmitted in a single time, the data transmission rate, the data transmission time distribution and the data transmission target address; compare the data transmission characteristics with the customer's historical transmission baseline, and if the data transmission characteristic value is less than or equal to the preset threshold, continue the data transmission; if the data transmission characteristic value is greater than the preset threshold, trigger the multi-factor identity authentication process; generate an audit log based on each authentication of the multi-factor identity authentication process, and prevent log tampering through blockchain technology, wherein the audit log includes the authentication trigger reason, authentication time, authentication result and authentication failure reason.

[0011] As a preferred solution of the information security management method for corporate customers described in the present invention, the multi-factor identity authentication process includes the following steps: starting biometric verification, performing identity matching through a pre-collected biometric template library, wherein the biometric verification includes face recognition and fingerprint comparison; at the same time, issuing a dynamic token to the mobile phone terminal reserved by the customer, and the system verifies the consistency between the biometric information submitted by the customer and the dynamic token, wherein the dynamic token is generated based on a timestamp and a unique customer identifier; when both the biometric verification and the dynamic token verification are passed, data transmission continues; if the biometric verification fails, the current session channel is immediately interrupted, the customer account is locked, and a biometric verification failure alarm message is pushed to the security administrator; if the biometric verification succeeds and the dynamic token verification fails, the current session channel connection is maintained, the dynamic token is re-issued to the mobile phone terminal reserved by the customer, and the dynamic token is resubmitted for verification within the expected time; if all three verifications fail, the current session channel is interrupted and an abnormal log is recorded.

[0012] As a preferred solution of the information security management method for enterprise customers described in the present invention, wherein: a dynamic session channel is established for data transmission in the security control area, and keys are updated according to a preset time period, including: real-time monitoring of the data transmission channel in the security control area, and when a data transmission request is detected, a session key pair is generated based on an elliptic curve algorithm, wherein the session key pair includes a public key and a private key; a dynamic session channel is established between a data transmission source and a target end, wherein the dynamic session channel uses a public key to encrypt the transmission data, and the receiving end uses a private key for decryption; a validity period is set for the session key pair of the dynamic session channel, and a key update process is triggered according to a preset time period; the key update process includes that the system automatically generates a new session key pair, and distributes the new key to both communicating parties through the dynamic session channel, and after confirming that both parties have completed the key update, the resources of the original dynamic session channel are released and a new encryption channel is enabled; for a session channel that fails to complete the key update within the preset time period, the system interrupts data transmission and records an abnormal log.

[0013] As a preferred solution of the information security management method for enterprise customers described in the present invention, wherein: the division of the security control area is to divide the enterprise network environment into three security control areas based on the security level, wherein the security control area includes a first-level security control area, a second-level security control area and a third-level security control area; the security level includes a first-level security level, a second-level security level and a third-level security level; for the equipment and customers of the first-level security level, activities are limited to the third-level security control area, and all access rights are configured, wherein the full access rights include the upper limit of the number of system resource calls per day, the data access frequency threshold per unit time and the prohibition of access to the core business system; for the second-level security level, etc. For devices and customers at the third level of security, they are allowed to move in the first level of security control area and configure some access rights, where the partial access rights include setting a total limit on system resource calls, a limit on the amount of core data accessed at one time, and prohibiting access during a specific time period; for devices and customers at the third level of security, they are allowed to move in the first level of security control area and configure basic access rights, where the basic access rights include regular system resource call limits and data access frequency monitoring; at the same time, data encryption policies are set for the security control areas, where the first level of security control area uses a national secret algorithm for full encryption; the second level of security control area selectively encrypts sensitive data; and the third level of security control area implements basic security encryption.

[0014] As a preferred solution of the information security management method for enterprise customers described in the present invention, wherein: the method for generating the security level is to acquire device identification information data and operation behavior data in real time and transmit them to the security management platform through security probes deployed in the enterprise intranet; construct and train a security baseline model through a neural network algorithm, wherein the security baseline model includes device dimension scoring rules and behavior dimension scoring rules; input the device identification information data into the device dimension scoring rules for calculation to obtain the device security score; at the same time, input the operation behavior data into the behavior dimension scoring rules for calculation to obtain the behavior security score; and generate a security level based on the weighted calculation result of the device security score and the behavior security score.

[0015] As a preferred solution of the information security management method for enterprise customers of the present invention, the specific formula of the device security score is as follows:

[0016]

[0017] Among them, DS is the device security score, ε is the number of device security features, and w i is the weight coefficient of device safety feature i, λ is the time decay factor, c i is the detection time interval of device security feature i, Y i is the terminal credibility value of device security feature i, d i is the measured value of the equipment safety feature i, It is the device characteristic baseline value.

[0018] The specific formula for the behavioral safety score is as follows:

[0019]

[0020] Among them, BS is the behavior safety score, τ is the number of behavior safety features, T is the evaluation time window, α j is the feature weight of behavioral safety feature j, x j (t) is the real-time value of the behavioral safety feature j, μ j is the baseline value of behavioral safety feature j, σ j is the standard deviation of behavioral safety feature j, f is the current operation frequency, f0 is the benchmark operation frequency, and t is the evaluation time interval.

[0021] In the second aspect, an embodiment of the present invention provides an information security management system for enterprise customers, comprising: a collection module, used to collect device identification information data and operation behavior data of enterprise customers, and to perform security scoring on the device identification information data and operation behavior data through a security baseline model to generate a security level; a division module, used to divide security control areas according to the security level, and configure access rights and data encryption policies; an establishment module, used to establish a dynamic session channel for data transmission in the security control area, and to update keys according to a preset time period; a trigger module, used to monitor the data transmission characteristics within the dynamic session channel, and trigger multi-factor identity authentication, and record audit logs, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

[0022] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the information security management method for enterprise customers as described in the first aspect of the present invention are implemented.

[0023] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the information security management method for enterprise customers as described in the first aspect of the present invention are implemented.

[0024] The beneficial effects of the present invention are as follows: the present invention establishes an accurate quantitative assessment mechanism for equipment and user behavior through a security baseline model to achieve dynamic and comprehensive perception of security risks; differentiated management and control area division based on security levels makes security resource allocation more refined and intelligent; the establishment of dynamic session channels and periodic key update mechanism effectively reduce the security vulnerability of data transmission; the synergy of multi-factor identity authentication and audit log recording improves the reliability of identity authentication and behavior traceability, which can not only respond to complex security threats in real time, but also provide enterprises with more comprehensive and efficient information security management solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0026] Figure 1 This is a flow chart of the information security management method for corporate customers in Example 1. DETAILED DESCRIPTION

[0027] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0028] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0029] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0030] Example 1

[0031] Reference Figure 1 , which is the first embodiment of the present invention, and which provides an information security management method for enterprise customers, comprising:

[0032] S1: Collect device identification information data and operation behavior data of enterprise customers, and perform security scoring on the device identification information data and operation behavior data through a security baseline model to generate a security level.

[0033] Specifically, the device identification information data includes the device type, device unique identification code, device IP address, device MAC address and device login geographic location; the operation behavior data includes system login time, access application type, file operation records, network access records and data transmission records.

[0034] Furthermore, through the security probes deployed in the enterprise intranet, the device identification information data and operation behavior data are obtained in real time and transmitted to the security management platform; the security baseline model is constructed and trained through the neural network algorithm, where the security baseline model includes device dimension scoring rules and behavior dimension scoring rules. The device dimension scoring rules are to conduct a comprehensive analysis and evaluation of the time characteristics of system login behavior, the sensitivity of access applications, the abnormality of file operations, the compliance of network access, and the risk level of data transmission.

[0035] It should be noted that the security levels include level one security level, level two security level and level three security level.

[0036] Furthermore, the device identification information data is input into the device dimension scoring rules for calculation to obtain the device security score. The specific formula is as follows:

[0037]

[0038] Among them, DS is the device security score, ε is the number of device security features, and w i is the weight coefficient of device safety feature i, λ is the time decay factor, c i is the detection time interval of device security feature i, Y i is the terminal credibility value of device security feature i, d i is the measured value of the equipment safety feature i, It is the device characteristic baseline value.

[0039] Furthermore, the operation behavior data is input into the behavior dimension scoring rules for calculation to obtain the behavior safety score. The specific formula is as follows:

[0040]

[0041] Among them, BS is the behavior safety score, τ is the number of behavior safety features, T is the evaluation time window, α j is the feature weight of behavioral safety feature j, x j (t) is the real-time value of the behavioral safety feature j, μ j is the baseline value of behavioral safety feature j, σ j is the standard deviation of behavioral safety feature j, f is the current operation frequency, f0 is the benchmark operation frequency, and t is the evaluation time interval.

[0042] Furthermore, the security level is generated based on the weighted calculation results of the device security score and the behavior security score. When the device security score is greater than the device security threshold and the behavior security score is greater than the baseline threshold, and the device is located in a trusted geographic area and the security patch update has been completed recently, and the time distribution of the operation behavior conforms to the normal distribution law, and the data access frequency is lower than the warning threshold, then the enterprise customer is at the first level of security level; when the device security score is equal to the device security threshold or the behavior security score is equal to the baseline threshold, and the device is located in a restricted geographic area or the security patch update time exceeds the warning cycle, or the time distribution of the operation behavior deviates slightly, or the data access frequency approaches the warning threshold, then the enterprise customer is at the second level of security level; when the device security score is less than the device security threshold or the behavior security score is less than the baseline threshold, or the device is located in a prohibited access geographic area or there is a lack of high-risk security patches, or the time distribution of the operation behavior seriously deviates from the normal law, or the data access frequency exceeds the warning threshold, then the enterprise customer is at the third level of security level.

[0043] It should be noted that the device security threshold is based on the device's own historical security indicators and industry standards; the benchmark threshold is based on the statistical analysis of corporate customers' normal business operations and security management experience; and the warning threshold is based on the statistical analysis of data access frequency and security risk warning requirements.

[0044] S2: Divide the security control area according to the security level, and configure access rights and data encryption policies.

[0045] Specifically, the security control areas are divided into three security control areas based on security levels, where the security control areas include a first-level security control area, a second-level security control area, and a third-level security control area.

[0046] Furthermore, if the current security level of the enterprise customer is the first-level security level, and the recent device security score and behavior security score remain stable, and the device is located within the enterprise's physical security boundary, it is allowed to access the first-level security control area and granted access rights; if the first-level security control area shows a downward trend in security scores, and the device security characteristics deviate from the baseline value, or the behavior characteristics exceed the normal range, it will be downgraded to the second-level security control area and can temporarily obtain access rights; if the current security level of the enterprise customer is the third-level security level, and the security score fluctuates frequently, it must be strictly isolated in the third-level security control area;

[0047] Furthermore, if the security level of the current corporate customer changes and the change continues for more than the observation period, the automatic switching mechanism of the security control area will be triggered; if a security threat occurs in any security area and the impact range may spread, the regional isolation and resource scheduling strategy will be initiated.

[0048] Specifically, the resource scheduling strategy is as follows: if the resource load of a security control area reaches the upper limit and there is access competition, the resource needs of customers with high security levels will be prioritized; if an enterprise customer needs to exit the current security control area and there are unfinished business operations, security caching and data synchronization processing will be performed.

[0049] Furthermore, for devices and customers with a first-level security level, activities are restricted to the third-level security control area, and full access rights are configured, where full access rights include an upper limit on the number of system resource calls per day, a data access frequency threshold per unit time, and prohibition of access to core business systems; for devices and customers with a second-level security level, activities are allowed in the second-level security control area, and partial access rights are configured, where partial access rights include setting a total limit on system resource calls, a single access limit to core data, and prohibition of access during specific time periods; for devices and customers with a third-level security level, activities are allowed in the first-level security control area, and basic access rights are configured, where basic access rights include regular system resource call limits and data access frequency monitoring.

[0050] Furthermore, data encryption policies are set for security control areas. The first-level security control area uses the national secret algorithm for full encryption; the second-level security control area selectively encrypts sensitive data; and the third-level security control area implements basic security encryption. Access rights include system resource call restrictions and data access frequency thresholds; data encryption policies are uniformly distributed and managed by the key management center to ensure the security of data when it flows between different security control areas.

[0051] S3: Establish a dynamic session channel for data transmission in the security control area, and update the key according to a preset time period.

[0052] Specifically, the data transmission channels in the security control area are monitored in real time. When a data transmission request is detected, a session key pair is generated based on the elliptic curve algorithm, where the session key pair includes a public key and a private key. A dynamic session channel is established between the data transmission source and the target end, where the dynamic session channel uses the public key to encrypt the transmitted data, and the receiving end uses the private key to decrypt it. A validity period is set for the session key pair of the dynamic session channel, and the key update process is triggered according to a preset time period.

[0053] Furthermore, the key update process includes the system automatically generating a new session key pair and distributing the new key to the communicating parties through the dynamic session channel. After confirming that both parties have completed the key update, the resources of the original dynamic session channel are released and the new encryption channel is enabled.

[0054] Furthermore, for a session channel that fails to complete the key update within a preset time period, the system interrupts data transmission and records an abnormal log.

[0055] It should be noted that the preset time period can be configured differently based on different security control areas, among which the key update period of the first-level security control area is the shortest, the second-level security control area is the second, and the third-level security control area is the longest.

[0056] S4: Monitor the data transmission characteristics in the dynamic session channel, trigger multi-factor identity authentication, and record an audit log, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

[0057] Specifically, the triggering method of multi-factor identity authentication is to deploy a data transmission monitoring module in the dynamic session channel to collect data transmission characteristics in real time, where the data transmission characteristics include the amount of data transmitted in a single time, the data transmission rate, the data transmission time distribution and the data transmission target address; compare the data transmission characteristics with the customer's historical transmission baseline, and if the data transmission characteristic value is less than or equal to the preset threshold, continue the data transmission; if the data transmission characteristic value is greater than the preset threshold, trigger the multi-factor identity authentication process.

[0058] Furthermore, the multi-factor identity authentication process includes the following steps: initiating biometric verification, performing identity matching through a pre-collected biometric template library, wherein the biometric verification includes face recognition and fingerprint comparison; at the same time, issuing a dynamic token to the mobile phone terminal reserved by the customer, and the system verifies the consistency between the biometric information submitted by the customer and the dynamic token, wherein the dynamic token is generated based on a timestamp and the customer's unique identifier.

[0059] Furthermore, when both the biometric verification and the dynamic token verification are passed, data transmission continues; if the biometric verification fails, the current session channel is immediately interrupted, the customer account is locked, and the biometric verification failure alarm information is pushed to the security administrator; if the biometric verification succeeds and the dynamic token verification fails, the current session channel connection is maintained, the dynamic token is re-issued to the customer's reserved mobile terminal, and the dynamic token is resubmitted for verification within the expected time; if all three verifications fail, the current session channel is interrupted and the abnormal log is recorded.

[0060] Specifically, an audit log is generated based on each authentication in the multi-factor identity authentication process, and blockchain technology is used to prevent log tampering. The audit log includes the authentication trigger reason, authentication time, authentication result, and authentication failure reason.

[0061] Furthermore, the present embodiment also provides an information security management system for enterprise customers, including: a collection module, used to collect device identification information data and operation behavior data of enterprise customers, and to perform security scoring on the device identification information data and operation behavior data through a security baseline model to generate a security level; a division module, used to divide the security control area according to the security level, and configure access rights and data encryption policies; an establishment module, used to establish a dynamic session channel for data transmission in the security control area, and to update the key according to a preset time period; a trigger module, used to monitor the data transmission characteristics within the dynamic session channel, and trigger multi-factor identity authentication, and record audit logs, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

[0062] This embodiment also provides a computer device suitable for the information security management method for corporate customers, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the information security management method for corporate customers proposed in the above embodiment.

[0063] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0064] The present embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps: collecting device identification information data and operation behavior data of enterprise customers, performing security scoring on the device identification information data and operation behavior data through a security baseline model, and generating a security level; dividing security control areas according to the security levels, and configuring access rights and data encryption policies; establishing a dynamic session channel for data transmission in the security control area, and updating keys according to a preset time period; monitoring the data transmission characteristics of the dynamic session channel, and triggering multi-factor identity authentication, and recording an audit log, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

[0065] In summary, the present invention establishes an accurate quantitative assessment mechanism for equipment and user behavior through a security baseline model to achieve dynamic and comprehensive perception of security risks; differentiated management and control area division based on security levels makes security resource allocation more refined and intelligent; the establishment of dynamic session channels and periodic key update mechanism effectively reduce the security vulnerability of data transmission; the synergy of multi-factor identity authentication and audit log recording improves the reliability of identity authentication and behavior traceability, which can not only respond to complex security threats in real time, but also provide enterprises with more comprehensive and efficient information security management solutions.

[0066] Example 2

[0067] Referring to Table 1, which is a second embodiment of the present invention, this embodiment provides an information security management method for enterprise customers. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0068] Specifically, a financial technology company was selected as the research object, and the operation logs and access records from 100 key devices within 30 days were collected to construct an initial data set; device identification information was collected through security probes, including device model, hardware fingerprint and network MAC address; at the same time, user operation behaviors were recorded, such as login time, access resources and data transmission.

[0069] Furthermore, in the data preprocessing stage, the collected raw data is cleaned and standardized; a multi-dimensional feature vector is established, including device credibility, operation frequency, and abnormal behavior. A security baseline model is constructed by utilizing a neural network algorithm through repeated training and tuning. The experiment focuses on verifying the effectiveness of multi-factor authentication and simulating the authentication process under different security scenarios. Biometric verification uses live face recognition and fingerprint matching technology, and a dynamic token is generated in real time based on a timestamp and a user's unique identifier. When an abnormal transmission feature is detected, the multi-factor authentication process is immediately triggered to ensure data security.

[0070] Furthermore, as shown in Table 1, the anomaly detection rate is reduced from 2.5% of the traditional method to 0.02%, which means that the system has the ability to identify security threats. This accuracy comes from the multi-dimensional security baseline model built by the neural network algorithm, which can capture tiny abnormal behavior characteristics.

[0071] Table 1 Comparison between the present invention and the traditional method

[0072] Comparison Dimensions Traditional safety management methods Method of the present invention Performance improvement rate (%) Anomaly detection rate (%) 2.5 0.02 99.2 Identity authentication success rate (%) 85.6 99.9 16.7 Key update frequency (times / day) 1.2 12.0 900.0 Data encryption strength (bits) 128 4096 3100.0 Resource access limit (times / day) 500 50 90.0 Average response time (ms) 280 15 94.6 Multi-factor authentication flexibility Single Dimension Multi-dimensional dynamics 100.0 Security level classification granularity Extensive Refined grading 100.0

[0073] Specifically, the authentication success rate has jumped from 85.6% of the traditional method to 99.9%, an increase of 16.7%. This breakthrough is due to the introduction of a multi-factor authentication mechanism, which improves the accuracy and reliability of identity authentication through biometric recognition and dynamic token verification. The key update frequency has increased from 1.2 times / day of the traditional method to 12.0 times / day, with a performance improvement rate of up to 900%, greatly reducing the risk of data being attacked. Dynamic session channel management based on elliptic curve algorithm makes the encryption process more real-time and efficient.

[0074] Furthermore, in terms of data encryption strength, the performance has been improved by 3100% from the traditional 128-bit to 4096-bit. Through the national secret algorithm and multi-level encryption strategy, data of different security levels are protected by differentiated encryption. Resource access restrictions have been reduced from 500 times / day to 50 times / day, a decrease of 90%. Through the hierarchical management and control of the enterprise network environment, access rights can be dynamically adjusted according to the security level of the device and user, achieving more intelligent and accurate security defense.

[0075] Furthermore, the average response time was reduced from 280ms to 15ms, and the performance optimization rate was as high as 94.6%. This means that the negative impact of the introduction of the security management mechanism on system performance has been minimized. The flexibility of multi-factor authentication and the granularity of security level division have both achieved 100% innovation improvement. Compared with traditional extensive management.

[0076] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An information security management method for enterprise customers, characterized in that: include, Collecting device identification information data and operation behavior data of enterprise customers, and performing security scoring on the device identification information data and operation behavior data through a security baseline model to generate a security level; Divide security control areas according to the security levels, and configure access rights and data encryption policies; Establishing a dynamic session channel for data transmission in the security control area and updating the key according to a preset time period; The data transmission characteristics of the dynamic session channel are monitored, and multi-factor identity authentication is triggered and an audit log is recorded, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

2. The information security management method for enterprise customers according to claim 1, characterized in that: The triggering method of the multi-factor identity authentication is: Deploy a data transmission monitoring module in the dynamic session channel to collect data transmission characteristics in real time, wherein the data transmission characteristics include a single transmission data volume, a data transmission rate, a data transmission time distribution, and a data transmission target address; Compare the data transmission characteristics with the customer's historical transmission baseline. If the data transmission characteristic value is less than or equal to a preset threshold, continue data transmission; if the data transmission characteristic value is greater than the preset threshold, trigger a multi-factor identity authentication process; An audit log is generated based on each authentication of the multi-factor identity authentication process, and blockchain technology is used to prevent log tampering, wherein the audit log includes the authentication trigger reason, authentication time, authentication result and authentication failure reason.

3. The information security management method for enterprise customers according to claim 2, characterized in that: The multi-factor identity authentication process includes the following steps: Initiate biometric verification and perform identity matching through a pre-collected biometric template library, wherein the biometric verification includes face recognition and fingerprint comparison; At the same time, a dynamic token is sent to the mobile phone terminal reserved by the customer, and the system verifies the consistency between the biometric information submitted by the customer and the dynamic token, where the dynamic token is generated based on the timestamp and the customer's unique identifier; When both the biometric verification and the dynamic token verification are passed, data transmission continues; if the biometric verification fails, the current session channel is immediately interrupted, the customer account is locked, and the biometric verification failure alarm information is pushed to the security administrator; if the biometric verification succeeds and the dynamic token verification fails, the current session channel connection is maintained, the dynamic token is re-issued to the customer's reserved mobile terminal, and the dynamic token is resubmitted for verification within the expected time; if all three verifications fail, the current session channel is interrupted and the exception log is recorded.

4. The information security management method for enterprise customers according to claim 3, characterized in that: Establishing a dynamic session channel for data transmission in the security control area and updating the key according to a preset time period, including: The data transmission channel of the security control area is monitored in real time, and when a data transmission request is detected, a session key pair is generated based on an elliptic curve algorithm, wherein the session key pair includes a public key and a private key; Establishing a dynamic session channel between a data transmission source and a target end, wherein the dynamic session channel uses a public key to encrypt the transmission data, and the receiving end uses a private key to decrypt the data; Setting a validity period for the session key pair of the dynamic session channel, and triggering a key update process according to a preset time period; The key update process includes: the system automatically generates a new session key pair, distributes the new key to both parties through the dynamic session channel, and after confirming that both parties have completed the key update, releases the resources of the original dynamic session channel and enables the new encryption channel; For session channels that fail to complete key update within a preset time period, the system interrupts data transmission and records an exception log.

5. The information security management method for enterprise customers according to claim 4, characterized in that: The security control area is divided into: Based on the security level, the enterprise network environment is divided into three security control areas, wherein the security control areas include a primary security control area, a secondary security control area and a tertiary security control area; the security level includes a primary security level, a secondary security level and a tertiary security level; For the devices and customers of the first-level security level, activities are restricted to the third-level security control area and all access rights are configured, where the full access rights include the upper limit of the number of system resource calls per day, the data access frequency threshold per unit time, and the prohibition of access to core business systems; For devices and customers of the second-level security level, activities are allowed in the second-level security control area and partial access rights are configured, where the partial access rights include setting total system resource call limits, single core data access limits, and prohibiting access during specific time periods; For the devices and customers of the third-level security level, activities are allowed in the first-level security control area and basic access rights are configured, where the basic access rights include regular system resource call restrictions and data access frequency monitoring; At the same time, a data encryption strategy is set for the security control area, wherein the first-level security control area adopts the national secret algorithm for full encryption; The secondary security control area selectively encrypts sensitive data; the tertiary security control area implements basic security encryption.

6. The information security management method for enterprise customers according to claim 5, characterized in that: The method for generating the security level is: Through the security probes deployed on the enterprise intranet, device identification information and operation behavior data are obtained in real time and transmitted to the security management platform; Building and training a security baseline model through a neural network algorithm, wherein the security baseline model includes device dimension scoring rules and behavior dimension scoring rules; Input the device identification information data into the device dimension scoring rule for calculation to obtain the device safety score; At the same time, the operation behavior data is input into the behavior dimension scoring rule for calculation to obtain the behavior safety score; A security level is generated according to a weighted calculation result of the device security score and the behavior security score.

7. The information security management method for enterprise customers according to claim 6, characterized in that: The specific formula for the equipment safety score is as follows: Among them, DS is the device security score, ε is the number of device security features, and w i is the weight coefficient of device safety feature i, λ is the time decay factor, c i is the detection time interval of device security feature i, Y i is the terminal credibility value of device security feature i, d i is the measured value of the equipment safety feature i, is the equipment characteristic reference value; The specific formula for the behavioral safety score is as follows: Among them, BS is the behavior safety score, τ is the number of behavior safety features, T is the evaluation time window, α j is the feature weight of behavioral safety feature j, x j (t) is the real-time value of behavioral safety feature j, μ j is the baseline value of behavioral safety feature j, σ j is the standard deviation of behavioral safety feature j, f is the current operation frequency, f0 is the benchmark operation frequency, and t is the evaluation time interval.

8. An information security management system for corporate customers, based on the information security management method for corporate customers according to any one of claims 1 to 7, characterized in that: Also includes, A collection module, used to collect device identification information data and operation behavior data of enterprise customers, and to perform security scoring on the device identification information data and operation behavior data through a security baseline model to generate a security level; A division module divides security control areas according to the security level and configures access rights and data encryption policies; An establishment module is used to establish a dynamic session channel for data transmission in the security control area and update the key according to a preset time period; The trigger module is used to monitor the data transmission characteristics in the dynamic session channel, trigger multi-factor identity authentication, and record audit logs, wherein the multi-factor identity authentication includes biometric verification and dynamic token verification.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the information security management method for enterprise customers described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the information security management method for enterprise customers described in any one of claims 1 to 7 are implemented.

Images