Authority control system and authority control method

Abstract

The invention provides an authority control system and method, and relates to the technical field of communication, and the system comprises a data analysis server which is used for analyzing spatio-temporal data, processing network events and network threats, monitoring abnormal activities in a network, generating a monitoring result, and sending the monitoring result to a control management server. And the control management server is used for adjusting the network access authority in real time according to the monitoring result. And the identity authentication server is used for performing identity authentication on the user terminal according to the network access authority and providing an identifier of the user terminal passing the identity authentication for the network resource server. And the network resource server is used for providing network resources for the user terminal passing the identity authentication according to the identifier of the user terminal passing the identity authentication provided by the identity authentication server. The problems of high implementation cost and low compatibility of a zero-trust network in the prior art are solved, and the technical effect of permission control under the condition of low implementation cost is achieved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authority control system and an authority control method. Background Art

[0002] Zero Trust Network is a new type of network security architecture that abandons the traditional boundary-based security strategy, which is the practice of trusting internal networks and users by default, and requires strict verification and authorization of each access request.

[0003] In the process of implementing the technical solution of the invention in the embodiment of the present application, the inventors of the present application found that the above technology has at least the following technical problems:

[0004] Zero-trust networks require enterprises to not only rely on traditional authentication methods to determine whether to trust a user, host, or application that requests access to specific enterprise resources, but also need to make decisions based on a series of more complex conditions. In order to achieve this goal, it is necessary to use micro-isolation technology to define network boundaries at a more granular level and formulate corresponding access control rules; in addition, the zero-trust network model also relies on the collaboration of multiple security protocols and routing technologies. Micro-isolation technology increases the complexity of network architecture and the difficulty of formulating security policies, resulting in higher implementation costs. There are compatibility issues when multiple security protocols and routing technologies work together. Summary of the invention

[0005] The present application provides a permission control system and method to solve the problems of high implementation cost and low compatibility of zero-trust networks.

[0006] In a first aspect, the present application provides a permission control system, including: a data analysis server, a control management server, an identity authentication server, and a network resource server;

[0007] The data analysis server is used to analyze spatiotemporal data, process network events and network threats, and monitor abnormal activities in the network, generate monitoring results, and send them to the control management server, wherein the spatiotemporal data refers to data related to network traffic and user behavior;

[0008] The control management server is used to adjust the network access rights in real time according to the monitoring results;

[0009] The identity authentication server is used to authenticate the user terminal according to the network access rights and provide the network resource server with the identification of the user terminal that has passed the identity authentication;

[0010] The network resource server is used to provide network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server, and the network resources include application programs and network data.

[0011] In some embodiments, the data analysis server includes a spatiotemporal data mining module, and the spatiotemporal data mining module is used to:

[0012] Analyze the spatiotemporal data to establish a behavior benchmark model and a security behavior baseline, wherein the behavior benchmark model is used to represent the user's common geographic location, network environment, terminal device, operation time, common applications and usage habits, and the security behavior baseline refers to the commonality of behavior of users with the same attributes;

[0013] Determine normal behavior patterns and abnormal behavior patterns through the behavior benchmark model and the safety behavior baseline;

[0014] Analyzing the spatiotemporal data to determine a spatiotemporal correlation pattern, wherein the spatiotemporal correlation pattern is used to represent the correlation of behaviors at different times and spaces;

[0015] A behavior analysis result is generated according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern.

[0016] In some embodiments, the data analysis server further includes a user behavior analysis module, and the user behavior analysis module is used to:

[0017] Analyzing user behavior patterns based on the behavior analysis results, wherein the user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network;

[0018] Through the user behavior pattern, the identity and behavior characteristics of the user are identified, the user's behavior is predicted, potential abnormal behavior and attack behavior are determined, and the monitoring result is generated.

[0019] In some embodiments, the control management server includes a network control management module, and the network control management module is used to:

[0020] Formulate permission control strategies based on the monitoring results;

[0021] The network access rights are adjusted through the authority control policy.

[0022] In some embodiments, the control management server further includes a network attack detection and prevention module, and the network attack detection and prevention module is used to:

[0023] monitoring the spatiotemporal data;

[0024] Analyze the spatiotemporal data to determine whether there is abnormal behavior or aggressive behavior;

[0025] When the abnormal behavior or the attack behavior exists, differential isolation of network resources is performed according to the abnormal behavior or the attack behavior.

[0026] In some embodiments, the data analysis server further includes a data acquisition module, and the data acquisition module is used to:

[0027] Collect user behavior data and network traffic data through sensor devices, the user behavior data includes geographic location, spatial movement information, surrounding information and temperature information, and the network traffic data includes traffic data, threat intelligence, device status information and operation logs;

[0028] Original data is obtained according to the user behavior data and the network traffic data.

[0029] In some embodiments, the data analysis server further includes a data preprocessing module, and the data preprocessing module is used to:

[0030] Scanning the raw data, removing redundant information, irrelevant information and obvious errors in the raw data, and obtaining preliminary cleansed data;

[0031] Identifying noise and outliers in the preliminary cleaned data, removing the noise and outliers, and obtaining purified data;

[0032] The cleansed data is uniformly converted according to a preset standard format to obtain standard format data, wherein the preset standard format includes a data type, a coding format, and a date format;

[0033] Cleaning invalid records and obvious errors in the standard format data to obtain valid data;

[0034] According to a preset standard, the valid data is normalized and standardized to obtain the spatiotemporal data, wherein the preset standard refers to a rule or parameter for guiding data conversion;

[0035] The spatiotemporal data are integrated to construct a spatiotemporal dataset.

[0036] In a second aspect, the present application provides a permission control method, which is applied to a permission control system and comprises the following steps:

[0037] The data analysis server analyzes the spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates the monitoring results, and sends them to the control management server, wherein the spatiotemporal data refers to data related to network traffic and user behavior;

[0038] The control management server adjusts the network access permission in real time according to the monitoring result;

[0039] The identity authentication server authenticates the user terminal according to the network access right, and provides the network resource server with the identification of the user terminal that has passed the identity authentication;

[0040] The network resource server provides network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server. The network resources include application programs and network data.

[0041] In some embodiments, the data analysis server analyzes the spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates monitoring results, and sends them to the control management server, including the following steps:

[0042] Analyze the spatiotemporal data to establish a behavior benchmark model and a security behavior baseline, wherein the behavior benchmark model is used to represent the user's common geographic location, network environment, terminal device, operation time, common applications and usage habits, and the security behavior baseline refers to the commonality of behavior of users with the same attributes;

[0043] Determine normal behavior patterns and abnormal behavior patterns through the behavior benchmark model and the safety behavior baseline;

[0044] Analyzing the spatiotemporal data to determine a spatiotemporal correlation pattern, wherein the spatiotemporal correlation pattern is used to represent the correlation of behaviors at different times and spaces;

[0045] A behavior analysis result is generated according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern.

[0046] In some embodiments, after generating the behavior analysis result according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern, the following steps are further included:

[0047] Analyzing user behavior patterns based on the behavior analysis results, wherein the user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network;

[0048] Through the user behavior pattern, the identity and behavior characteristics of the user are identified, the user's behavior is predicted, potential abnormal behavior and attack behavior are determined, and the monitoring result is generated.

[0049] Compared with the prior art, this application has the following advantages:

[0050] The data analysis server comprehensively reflects the security situation of the network and sends it to the control management server in a timely manner to provide support for permission control. The control management server responds to the monitoring results sent by the data analysis server and adjusts the network access rights in real time, effectively preventing potential security threats and enhancing the overall security of the network. The identity authentication server authenticates the user terminal according to the network access rights set by the control management server, ensuring the accuracy and security of the authentication process. The network resource server provides network resources to the user terminal that has passed the identity authentication according to the user ID sent by the user authentication server, ensuring the rational use of network resources. The problem of high implementation cost and low compatibility of zero-trust networks in the existing technology is solved, and the technical effect of realizing permission control at a low implementation cost is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a schematic diagram of the structure of a permission control system provided by at least one embodiment of the present application;

[0052] Figure 2 is an architectural diagram of a permission control system provided by at least one embodiment of the present application;

[0053] Figure 3 is a structural diagram of a data analysis server provided by at least one embodiment of the present application;

[0054] Figure 4 is a schematic diagram of the structure of a control management server provided by at least one embodiment of the present application;

[0055] Figure 5 is a structural diagram of a data analysis server provided by at least one embodiment of the present application;

[0056] Figure 6 is a flowchart of a method for permission control provided by at least one embodiment of the present application;

[0057] Figure 7 It is a flow chart of a method for generating monitoring results provided in at least one embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0059] Before describing the embodiments of the present application in detail, a brief introduction to the background technology involved in the present application is given.

[0060] Zero-trust network is an advanced security architecture with high application value and potential. The core idea of ​​zero-trust network is to not trust any external or internal users or devices, but to verify all people, things and objects that attempt to access the system before authorization. This network model breaks the traditional boundary protection thinking, focuses security on the resources themselves, and builds and deploys security around the entire life cycle of resources.

[0061] Zero-trust networks are mainly built with technologies such as identity and access management, terminal device environment risk assessment, attribute-based access control models, and machine learning-based identity analysis. These technical components work together to verify and authorize users and devices. However, there are also some practical problems and shortcomings in the use of zero-trust networks.

[0062] First, zero-trust networks require enterprises to use micro-segmentation and fine-grained boundary rules to determine whether to trust users / hosts / applications that request access to a specific scope of the enterprise based on conditions such as users, user locations, and other data. This requires enterprises to re-plan network architecture and security policies, increasing the complexity and cost of implementation.

[0063] Secondly, zero-trust networks require the use of multiple security protocols and routing technologies, but these protocols and technologies lack effective integrated management. Although IAM can be used in networks now, it is not used to determine how data packets are routed, which increases the complexity and management difficulty of the network.

[0064] In addition, zero-trust networks currently lack unified standards and specifications, and there are certain compatibility issues between the products and services of various manufacturers. At the same time, zero-trust networks require a large amount of computing and storage resources, as well as real-time monitoring and analysis of network traffic, which may have a certain impact on network performance.

[0065] The following are some technical keyword definitions involved in this application:

[0066] Spatiotemporal artificial intelligence: A machine learning technique that combines temporal and spatial data to analyze and understand spatial and temporal patterns in data.

[0067] Zero-trust network: A network security model whose basic principle is "don't trust, verify everything". It emphasizes that identity authentication and permission control must be performed in all network access.

[0068] Spatiotemporal data mining: A process of extracting valuable information and knowledge from spatiotemporal data, including pattern recognition, association rule mining, etc.

[0069] Data prediction: refers to the process of using existing data and models to predict and analyze future trends and results. Data prediction can help companies and individuals make more informed decisions and improve the accuracy and efficiency of decisions.

[0070] User behavior analysis: Through in-depth analysis of user behavior data, we can understand user needs and behavior patterns in order to provide personalized services and products.

[0071] Authentication: refers to the process of verifying and confirming the identity of a user to ensure that the user is a legitimate and authorized user. Authentication is an important part of network security, which can prevent unauthorized users from accessing sensitive data and resources. Common authentication methods include username and password, digital certificates, biometrics, etc.

[0072] Access control: refers to the mechanism for managing and controlling the access of users or systems to network resources, data or services. Access control can ensure that only authorized users or systems can access specific resources or services, preventing unauthorized access and potential security threats. Common access control methods include role-based access control (RBAC), attribute-based access control (ABAC), etc.

[0073] Network attack detection and prevention: refers to the timely detection and prevention of various network attacks by monitoring network traffic and user behavior.

[0074] Edge computing: A technology that distributes computing tasks to devices closer to the data source for processing to reduce network latency and improve response speed.

[0075] The embodiments of the present application have at least the following advantages:

[0076] 1. Higher security: Zero-trust network architecture is a safer model because it assumes that no one is trustworthy. This model prevents the exploitation of internal and external threats and reduces the attack surface that attackers can exploit. The present invention can further enhance the security of zero-trust networks by integrating spatiotemporal artificial intelligence. For example, by analyzing the user's spatiotemporal data and network behavior data, abnormal behaviors and potential attack behaviors can be more accurately identified, and corresponding protective measures can be taken in a timely manner to prevent data leakage and attacks.

[0077] 2. Better scalability and flexibility: Since the zero-trust network architecture does not rely on fixed boundaries and trust models, it has better scalability and flexibility. This means that it can adapt to different network environments and enterprise needs, and can be expanded as the enterprise grows. The present invention can further enhance the scalability and flexibility of the zero-trust network by integrating spatiotemporal artificial intelligence. For example, through an automated decision support system, intelligent authorization and management can be performed based on user behavior patterns, achieving more flexible network management and operation.

[0078] 3. Better visibility and control: Zero-trust network architecture provides better visibility and control because all devices, users, and applications must be verified and authenticated. This allows enterprises to better monitor and control the flow of data on the network and identify and respond to any threats in a timely manner. The present invention can further enhance the visibility and control capabilities of zero-trust networks by integrating spatiotemporal artificial intelligence. For example, by analyzing spatiotemporal data and network traffic data, the network environment and user behavior can be monitored more comprehensively, abnormal behavior and potential attack behaviors can be detected in a timely manner, and corresponding protective measures can be taken.

[0079] 4. Stronger automation and intelligence: By integrating spatiotemporal artificial intelligence technology, the present invention can achieve stronger automation and intelligence. For example, through the automated decision support system, intelligent authorization and management can be performed according to user behavior patterns, achieving more flexible network management and operation. At the same time, through technologies such as machine learning and deep learning, more accurate user behavior analysis and prediction can be achieved, improving network security and stability.

[0080] 5. Promote innovation and coordinated development of the industry: This invention can promote the innovation and development of related technologies and promote progress in the entire technology field. At the same time, by integrating spatiotemporal artificial intelligence technology, it can achieve more extensive data collection and analysis, promote cooperation and coordinated development between different manufacturers and different industries, and promote industrial development and innovation.

[0081] Embodiment 1

[0082] Reference Figure 1An embodiment of the present application provides a permission control system, including: a data analysis server 10, a control management server 20, an identity authentication server 30, and a network resource server 40.

[0083] The data analysis server 10 is used to analyze spatiotemporal data, process network events and network threats, and monitor abnormal activities in the network, generate monitoring results, and send them to the control management server 20. The spatiotemporal data refers to data about network traffic and user behavior.

[0084] Specifically, network traffic data includes traffic data, threat intelligence, device status information and operation logs, user behavior data includes geographic location information, spatial movement information, surrounding information and temperature information, network threats refer to the time that threatens network security, and abnormal activities in the network refer to activities that deviate from normal network behavior. The data analysis server 10 uses data mining technology and deep learning algorithms to deeply integrate, analyze and mine spatiotemporal data and network security intelligence, comprehensively understand network events and threats, monitor abnormal activities in the network, and provide support for intelligent decision-making. Exemplarily, data mining technology refers to frequent pattern mining algorithms including Apriori algorithm and FP tree algorithm, and deep learning algorithms refer to convolutional neural networks or recurrent neural networks.

[0085] The control management server 20 is used to adjust the network access rights in real time according to the monitoring results.

[0086] Specifically, the control management server 20 continuously monitors the network security and data analysis server 10, establishes a dynamic connection with the network resource server 40, and uses spatiotemporal data and intelligent analysis results to automatically make decisions to adjust network permissions and access control in real time to ensure the security and stability of the network. Intelligent analysis results refer to the results obtained by analyzing spatiotemporal data, and automated decision making refers to the network access permission adjustment strategy formulated based on the monitoring results. Exemplarily, the data analysis server 10 also includes a real-time threat detection system for monitoring abnormal activities in the network and establishing real-time communication with the real-time threat detection system.

[0087] The identity authentication server 30 is used to authenticate the user terminal according to the network access rights, and provide the identification of the user terminal that has passed the identity authentication to the network resource server 40 .

[0088] The network resource server 40 is used to provide network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server 30. The network resources include application programs and network data.

[0089] Specifically, a trusted connection is established between the identity authentication server 30 and the control management server 20 for authenticating the user. Application refers to software programs accessed by user terminals, including web browsers, email clients, etc. Network data refers to electronic data collected, stored, transmitted, processed and generated through the network.

[0090] For example, refer to Figure 2 The data analysis server 10 includes a data collection layer, a data preprocessing layer, a spatiotemporal data mining layer and a user behavior analysis layer, and the control management server 20 includes a network management and optimization layer, a data privacy protection layer, a network attack detection and prevention layer, and a control management layer.

[0091] Reference Figure 2 , the data collection layer collects spatiotemporal data from multiple sources, including user location, device status, network traffic data, threat intelligence, etc. The data preprocessing layer cleans, denoises, and formats the data, and integrates the collected spatiotemporal data into a comprehensive database to establish a comprehensive spatiotemporal data set. The spatiotemporal data mining layer uses data mining technology to deeply integrate, analyze, and mine spatiotemporal data and network security intelligence, comprehensively understand network events and threats, monitor abnormal activities in the network, and provide support for intelligent decision-making. The user behavior analysis layer analyzes user behavior patterns based on the results of spatiotemporal data mining to detect abnormal activities, trends, and correlations to ensure the credibility of their identities. By analyzing and predicting user behavior patterns, the user's identity and behavior characteristics, as well as possible abnormal and attack behaviors, can be identified. By analyzing and predicting user behavior patterns based on the results of spatiotemporal data mining, the user's identity and behavior characteristics can be identified, and abnormal behaviors and potential attack behaviors can be discovered. At the same time, through automated authorization and access control mechanisms, the flexibility and convenience of user behavior can be enhanced, and the user experience can be improved.

[0092] The control management server 20 uses an intelligent decision support system. According to the results of user behavior analysis and prediction, automated decision making can adjust network permissions and access control in real time to ensure the security and stability of the network; at the same time, by monitoring network traffic and user behavior, abnormal behavior and attack behavior can be discovered in time, and corresponding protective measures can be taken to enhance network security and stability. The network management and optimization layer is used to monitor and analyze network traffic and user behavior, dynamically adjust network access rights, achieve real-time access control, and optimize network management and operation. The data privacy protection layer uses encryption and hiding technologies to protect user data security and privacy. The network attack detection and prevention layer monitors network traffic and user behavior, detects abnormal behavior and attack behavior in time, and performs differential isolation of network resources. The control management layer continuously monitors network security and spatiotemporal data analysis systems, and uses spatiotemporal data and intelligent analysis results to automate decision making to adjust network permissions and access control in real time.

[0093] Specifically, the data privacy protection layer uses the distributed, decentralized and tamper-proof characteristics of blockchain technology to build a decentralized trust mechanism to ensure the authenticity and credibility of the data. At the same time, some data can be stored on the blockchain to improve the traceability and transparency of the data. The distributed storage and computing advantages of cloud computing technology can be used to achieve large-scale data processing and analysis, improve data processing efficiency and storage capacity. At the same time, the virtualization technology of cloud computing can be used to achieve rapid deployment and flexible expansion. Transferring some data processing and analysis tasks to edge devices can reduce data transmission delays and network loads, and improve data processing efficiency and response speed. At the same time, it can reduce network bandwidth requirements and cloud computing pressure.

[0094] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0095] The data analysis server 10 comprehensively reflects the security situation of the network and sends it to the control management server 20 in a timely manner to provide support for permission control. The control management server 20 responds to the monitoring results sent by the data analysis server 10 and adjusts the network access rights in real time, effectively preventing potential security threats and enhancing the overall security of the network. The identity authentication server 30 authenticates the user terminal according to the network access rights set by the control management server 20, ensuring the accuracy and security of the authentication process. The network resource server 40 provides network resources for the user terminal that has passed the identity authentication according to the user ID sent by the user authentication server, ensuring the rational use of network resources. The problem of high implementation cost and low compatibility of zero-trust networks in the prior art is solved, and the technical effect of realizing permission control at a low implementation cost is achieved.

[0096] Reference Figure 3 The data analysis server 10 includes a network resource server 11, which is used to: analyze spatiotemporal data, establish a behavior benchmark model and a security behavior baseline, the behavior benchmark model is used to represent the user's common geographical location, network environment, terminal equipment, operation time, common applications and usage habits, and the security behavior baseline refers to the common behavior of users with the same attributes.

[0097] Specifically, the behavioral baseline model and the security behavioral baseline are used to determine normal behavior patterns and abnormal behavior patterns. The behavioral baseline model is used to comprehensively and accurately represent the user's commonly used geographical locations, network environments, terminal devices, operating time, commonly used applications, and usage habits. Specifically, the behavioral baseline model will record the geographical location information that users frequently visit, such as home, company, or public places they often go to, as well as the network environment used in these locations, such as Wi-Fi, 4G / 5G, etc. At the same time, the user's terminal device information, such as mobile phone model, operating system version, etc., will also be included in the model to more comprehensively understand the user's usage environment. In addition, the model will also record in detail the user's operating time patterns, such as daily active hours, weekend and weekday usage differences, etc., as well as the user's commonly used applications and usage habits, such as preferred browsers, social media platforms, etc. Through the integration of this information, the behavioral baseline model can provide support for the subsequent determination of user behavior analysis data.

[0098] The security behavior baseline refers to the common characteristics of user behaviors with the same attributes that are further refined on the basis of the behavior baseline model. By finding out the common behavior patterns of user groups with similar attributes (such as geographical location, network environment, organizational department, etc.), such as the network access frequency of a certain type of user in a specific time period, the access order of commonly used applications, etc., it constitutes an important part of the security behavior baseline. By establishing a security behavior baseline, a reference standard is provided for monitoring abnormal activities in the network. By comparing the security behavior baseline with the user's behavior, abnormal activities in the network can be determined. Through the behavior baseline model and the security behavior baseline, normal behavior patterns and abnormal behavior patterns can be determined.

[0099] Specifically, the normal behavior patterns and abnormal behavior patterns determined by the behavioral baseline model and the security behavior baseline can clearly define the normal behavior boundaries of users and provide support for monitoring abnormal activities in the network.

[0100] Analyze spatiotemporal data and determine spatiotemporal correlation patterns, which are used to represent behavioral correlations at different times and spaces.

[0101] Specifically, the spatiotemporal correlation pattern is used to reveal the correlation between behaviors at different times, in different spaces, and at different times and spaces. When determining the spatiotemporal correlation pattern, first, by analyzing the behavioral activities at each time node, determine the changing trend and periodicity of the behavior over time; then, by analyzing the behavioral performance in different geographical locations, understand the impact of the regional environment on user behavior; finally, by combining the time and space dimensions, determine the spatiotemporal correlation pattern.

[0102] By determining the spatiotemporal correlation patterns, it is possible to reflect the behavioral habits of users at a specific time and place, and to reveal the mutual influence and dependency of behaviors in different spatiotemporal contexts, providing support for monitoring abnormal activities in the network.

[0103] Generate behavioral analysis results based on normal behavior patterns, abnormal behavior patterns, and spatiotemporal correlation patterns.

[0104] Specifically, by comparing the user's behavior data with normal behavior patterns, we can identify the behavior trajectories that conform to the norm. At the same time, based on the abnormal behavior patterns, we can mark and classify the behaviors that deviate from the normal trajectory or have abnormal characteristics, and timely discover abnormal activities in the network. Combined with the spatiotemporal correlation pattern, it helps to accurately grasp the overall trend of user behavior and identify the behavior patterns hidden in the complex spatiotemporal background.

[0105] In this embodiment, the spatiotemporal data mining technology is used to deeply analyze and mine the user's spatiotemporal data to obtain the user's behavior pattern and spatiotemporal correlation. The spatiotemporal data mining technology is used to deeply analyze and mine the spatiotemporal data to obtain the user's behavior pattern and spatiotemporal correlation, which provides support for subsequent user behavior analysis and prediction. At the same time, by mining the patterns and rules in the spatiotemporal data, potential security threats and attack behaviors can be discovered, improving network security and stability.

[0106] Reference Figure 3 The data analysis server 10 further includes a user behavior analysis module 12, which is used to:

[0107] Based on the behavior analysis results, user behavior patterns are analyzed, and user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network.

[0108] Through user behavior patterns, we can identify the user's identity and behavior characteristics, predict the user's behavior, determine potential abnormal behavior and attack behavior, and generate monitoring results.

[0109] Specifically, the monitoring results provide support for timely control of permissions by providing potential abnormal behaviors and attack behaviors, thereby improving the security and stability of the network. Analyzing user behavior patterns based on the results of behavioral analysis, and comprehensively analyzing data such as user activity trajectories, interaction habits, and preferences on the network, can help build an accurate user portrait. By comparing the differences between the user's current behavior and normal behavior patterns, abnormal activities such as abnormal login attempts and illegal data access can be discovered in a timely manner. At the same time, combined with the spatiotemporal correlation pattern, the time and place of abnormal behavior can be accurately located, providing support for determining potential abnormal and attack behaviors. Exemplarily, machine learning technology is used to conduct a deeper study and understanding of user behavior, establish a more sophisticated user behavior model, and improve the accuracy and efficiency of user behavior analysis and prediction.

[0110] In this embodiment, based on the results of spatiotemporal data mining, the user's behavior pattern is analyzed and predicted, and the user's identity and behavior characteristics, as well as possible abnormal behavior and attack behavior are identified. By analyzing and predicting the user's behavior pattern based on the results of spatiotemporal data mining, the user's identity and behavior characteristics can be identified, and abnormal behavior and potential attack behavior can be discovered. At the same time, through the automated authorization and access control mechanism, the flexibility and convenience of user behavior can be enhanced, and the user experience can be improved.

[0111] Reference Figure 4 The control management server 20 includes a network control management module 21, and the network control management module 21 is used to formulate an authority control strategy according to the monitoring results.

[0112] Adjust network access permissions through permission control policies.

[0113] Specifically, based on the monitoring results, we conduct in-depth analysis of the laws of network activities, user behavior patterns, and potential security risks, and formulate permission control strategies that take into account the needs of different users, the security requirements of business systems, and the sensitivity of network resources, while ensuring that normal work needs are met and security risks are effectively prevented.

[0114] For example, according to the permission control strategy, network access rights are adjusted by configuring access control lists, setting user permission levels, limiting the access scope of specific resources, etc., to achieve precise control of permissions, which not only ensures that legitimate users can smoothly access the required resources, but also effectively prevents intrusion by illegal users, thereby comprehensively improving the security and stability of the network system.

[0115] Reference Figure 4 The control management server 20 further includes a network attack detection and prevention module 22, which is used to:

[0116] Monitoring spatiotemporal data.

[0117] Analyze spatiotemporal data to determine whether there is abnormal behavior or aggressive behavior.

[0118] When there is abnormal behavior or attack behavior, network resource differential isolation is performed based on the abnormal behavior or attack behavior.

[0119] Specifically, by monitoring and analyzing spatiotemporal data, and when abnormal behavior or attack behavior is determined, differential isolation of network resources is performed to finely isolate the affected network resources or system parts to minimize the impact on normal business, while ensuring that abnormal behavior or attack behavior is effectively curbed, limiting the spread of abnormal traffic, and quickly restoring the normal operation of the network to ensure the overall security of the system.

[0120] In this embodiment, by monitoring network traffic and user behavior, abnormal behavior and attack behavior are discovered in time, and corresponding protective measures are taken to improve network security and stability. By monitoring network traffic and user behavior, abnormal behavior and attack behavior are discovered in time, and corresponding protective measures are taken, network security and stability can be improved, the core information assets of the enterprise can be protected, and potential security risks and attack surfaces can be reduced.

[0121] Reference Figure 5 The data analysis server 10 further includes a data collection module 13, which is used to:

[0122] Through sensor devices, user behavior data is collected, and network traffic data is obtained. User behavior data includes geographic location, spatial movement information, surrounding information and temperature information. Network traffic data includes traffic data, threat intelligence, device status information and operation logs.

[0123] The original data is obtained based on user behavior data and network traffic data.

[0124] Specifically, the use of sensor devices can collect user behavior data in multiple dimensions. Geographic location information is used to track spatial activity trajectories. Spatial movement information includes movement speed, movement direction, and stay duration, which is used to analyze user action patterns. Surrounding environment information includes WiFi hotspots and Bluetooth devices. Temperature information refers to the temperature of the user's terminal device. Surrounding environment information and temperature information are used to indicate the physical environment conditions of the user.

[0125] Network traffic data includes traffic data, network data transmission volume, transmission speed and transmission direction, providing a basis for analyzing network usage and bandwidth allocation; threat intelligence is used to capture malicious activities in the network, including virus attacks and malware propagation, ensuring network security; device status information is used to reflect the working status of user terminal devices, such as CPU occupancy rate, memory occupancy rate, etc., which helps to timely discover and solve device failures. Operation logs record all network activities of user login, logout, and data access, providing a reliable basis for tracing problems and auditing security.

[0126] By integrating user behavior data and network traffic data, we can obtain raw data to provide support for subsequent analysis, adjustment of network access rights, and implementation of differential isolation of network resources.

[0127] For example, connecting devices, sensors and networks through IoT technology can achieve more comprehensive and real-time data collection and monitoring, and improve the efficiency and quality of network management and operations.

[0128] In this embodiment, the user's spatiotemporal data and network traffic data are collected through multiple sensors and data sources, including the user's location information, device status, network traffic, etc. By collecting spatiotemporal data and network traffic data from multiple sources, a more comprehensive and accurate data source can be obtained, providing basic data support for subsequent data analysis and mining. At the same time, the use of multiple sensors and data sources can improve the diversity and reliability of data and reduce the error and uncertainty of a single data source.

[0129] Reference Figure 5 The data analysis server 10 further includes a data preprocessing module 14, which is used to:

[0130] Scan the original data, remove redundant information, irrelevant information and obvious errors in the original data, and obtain preliminary cleaned data.

[0131] Identify the noise and outliers in the preliminary cleaned data, remove the noise and outliers, and obtain the purified data.

[0132] According to the preset standard format, the purified data is uniformly converted to obtain standard format data. The preset standard format includes data type, encoding format and date format.

[0133] Clean invalid records and obvious errors in standard format data to obtain valid data.

[0134] According to preset standards, the valid data is normalized and standardized to obtain spatiotemporal data. The preset standards refer to the rules or parameters used to guide data conversion.

[0135] Integrate spatiotemporal data to construct spatiotemporal datasets.

[0136] Specifically, redundant information refers to information that appears repeatedly, irrelevant information refers to information that is irrelevant to the analysis target, and obvious errors include typos and unreasonable values. Noise refers to data fluctuations that are randomly generated or useless to the analysis results, and outliers refer to values ​​that significantly deviate from the normal data range. By setting reasonable thresholds and screening conditions, noise and outliers can be eliminated to obtain purified data to ensure data accuracy and reliability.

[0137] Use the preset standard format to uniformly convert the cleansed data, including clarifying the data type of each field. The data type refers to integer, floating point number or string to ensure the consistency of the data encoding format. By using a unified encoding format and standardizing the format of date data, you can get standard format data with a unified format and easy to process.

[0138] By cleaning up the missing key information and obviously illogical records in the standard format data, higher quality valid data can be obtained. According to the preset standards, the valid data is normalized, which means scaling the valid data to a specific range and eliminating the dimensional differences between different data; standardization is to convert the data into a form that conforms to the standard normal distribution by calculating the mean and standard deviation of the data to generate spatiotemporal data.

[0139] By organizing spatiotemporal data according to time sequence and spatial location, a spatiotemporal dataset can be constructed to provide a basis for subsequent analysis.

[0140] In this embodiment, by cleaning, denoising and formatting the collected data, invalid and erroneous data are removed, and the data is standardized and normalized, providing an accurate basis for subsequent data analysis and mining. By cleaning, denoising and formatting the collected data, the accuracy and reliability of the data can be improved, providing an accurate basis for subsequent data analysis and mining. At the same time, standardizing and normalizing the data can enhance the comparability and comprehensibility of the data, and facilitate the integration and analysis between different data sources.

[0141] Embodiment 2

[0142] Reference Figure 6 The present application provides a permission control method, which is applied to a permission control system and includes the following steps:

[0143] S10. The data analysis server analyzes spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates monitoring results, and sends them to the control management server. The spatiotemporal data refers to data about network traffic and user behavior.

[0144] S20. The control management server adjusts the network access rights in real time according to the monitoring results.

[0145] S30: The identity authentication server authenticates the user terminal according to the network access authority, and provides the network resource server with an identification of the user terminal that has passed the identity authentication.

[0146] S40: The network resource server provides network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server. The network resources include application programs and network data.

[0147] Reference Figure 7 ,The data analysis server analyzes the spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates monitoring results, and sends them to the control management server, including the following steps:

[0148] S11. Analyze spatiotemporal data and establish a behavioral baseline model and a security behavior baseline. The behavioral baseline model is used to represent the user's common geographic location, network environment, terminal device, operation time, common applications and usage habits. The security behavior baseline refers to the common behaviors of users with the same attributes.

[0149] S12. Determine normal behavior patterns and abnormal behavior patterns through behavioral baseline models and security behavior baselines.

[0150] S13. Analyze the spatiotemporal data to determine the spatiotemporal correlation pattern, which is used to represent the behavioral correlation at different times and spaces.

[0151] S14. Generate behavior analysis results based on normal behavior patterns, abnormal behavior patterns, and spatiotemporal correlation patterns.

[0152] Reference Figure 7 , after generating the behavior analysis results according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern, the following steps are also included:

[0153] S15. Analyze user behavior patterns based on the behavior analysis results. The user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network.

[0154] S16. Identify the user's identity and behavioral characteristics through user behavior patterns, predict user behavior, determine potential abnormal behavior and attack behavior, and generate monitoring results.

[0155] As for the method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0156] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0157] The above is a detailed introduction to the permission control system and method provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A permission control system, characterized in that: include: Data analysis server, control management server, identity authentication server, network resource server; The data analysis server is used to analyze spatiotemporal data, process network events and network threats, and monitor abnormal activities in the network, generate monitoring results, and send them to the control management server, wherein the spatiotemporal data refers to data related to network traffic and user behavior; The control management server is used to adjust the network access rights in real time according to the monitoring results; The identity authentication server is used to authenticate the user terminal according to the network access right, and provide the identification of the user terminal that has passed the identity authentication to the network resource server; The network resource server is used to provide network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server, and the network resources include application programs and network data.

2. The authority control system according to claim 1, characterized in that: The data analysis server includes a spatiotemporal data mining module, which is used to: Analyze the spatiotemporal data to establish a behavior benchmark model and a security behavior baseline, wherein the behavior benchmark model is used to represent the user's common geographic location, network environment, terminal device, operation time, common applications and usage habits, and the security behavior baseline refers to the commonality of behavior of users with the same attributes; Determine normal behavior patterns and abnormal behavior patterns through the behavior benchmark model and the safety behavior baseline; Analyzing the spatiotemporal data to determine a spatiotemporal correlation pattern, wherein the spatiotemporal correlation pattern is used to represent the correlation of behaviors at different times and spaces; A behavior analysis result is generated according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern.

3. The authority control system according to claim 2, characterized in that: The data analysis server further includes a user behavior analysis module, which is used to: Analyzing user behavior patterns based on the behavior analysis results, wherein the user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network; Through the user behavior pattern, the identity and behavior characteristics of the user are identified, the user's behavior is predicted, potential abnormal behavior and attack behavior are determined, and the monitoring result is generated.

4. The authority control system according to claim 2 or 3, characterized in that: The control management server includes a network control management module, and the network control management module is used to: Formulate permission control strategies based on the monitoring results; The network access rights are adjusted through the authority control policy.

5. The authority control system according to claim 4, characterized in that: The control management server also includes a network attack detection and prevention module, which is used to: monitoring the spatiotemporal data; Analyze the spatiotemporal data to determine whether there is abnormal behavior or aggressive behavior; When the abnormal behavior or the attack behavior exists, differential isolation of network resources is performed according to the abnormal behavior or the attack behavior.

6. The authority control system according to any one of claims 1 to 3, characterized in that: The data analysis server further includes a data acquisition module, which is used to: Collect user behavior data and network traffic data through sensor devices, the user behavior data includes geographic location, spatial movement information, surrounding information and temperature information, and the network traffic data includes traffic data, threat intelligence, device status information and operation logs; Original data is obtained according to the user behavior data and the network traffic data.

7. The authority control system according to claim 6, characterized in that: The data analysis server further includes a data preprocessing module, which is used to: Scanning the raw data, removing redundant information, irrelevant information and obvious errors in the raw data, and obtaining preliminary cleansed data; Identifying noise and outliers in the preliminary cleaned data, removing the noise and outliers, and obtaining purified data; The cleansed data is uniformly converted according to a preset standard format to obtain standard format data, wherein the preset standard format includes a data type, a coding format, and a date format; Cleaning invalid records and obvious errors in the standard format data to obtain valid data; According to a preset standard, the valid data is normalized and standardized to obtain the spatiotemporal data, wherein the preset standard refers to a rule or parameter for guiding data conversion; The spatiotemporal data are integrated to construct a spatiotemporal dataset.

8. A permission control method, characterized in that: The permission control system applied to any one of claims 1 to 7 comprises the following steps: The data analysis server analyzes the spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates the monitoring results, and sends them to the control management server, wherein the spatiotemporal data refers to data related to network traffic and user behavior; The control management server adjusts the network access permission in real time according to the monitoring result; The identity authentication server authenticates the user terminal according to the network access right, and provides the network resource server with the identification of the user terminal that has passed the identity authentication; The network resource server provides network resources to the user terminal that has passed the identity authentication according to the identifier of the user terminal that has passed the identity authentication provided by the identity authentication server. The network resources include application programs and network data.

9. The method according to claim 8, characterized in that The data analysis server analyzes the spatiotemporal data, processes network events and network threats, and monitors abnormal activities in the network, generates monitoring results, and sends them to the control management server, including the following steps: Analyze the spatiotemporal data to establish a behavior benchmark model and a security behavior baseline, wherein the behavior benchmark model is used to represent the user's common geographic location, network environment, terminal device, operation time, common applications and usage habits, and the security behavior baseline refers to the commonality of behavior of users with the same attributes; Determine normal behavior patterns and abnormal behavior patterns through the behavior benchmark model and the safety behavior baseline; Analyzing the spatiotemporal data to determine a spatiotemporal correlation pattern, wherein the spatiotemporal correlation pattern is used to represent the correlation of behaviors at different times and spaces; A behavior analysis result is generated according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern.

10. The method according to claim 9, characterized in that After generating the behavior analysis result according to the normal behavior pattern, the abnormal behavior pattern and the spatiotemporal correlation pattern, the following steps are also included: Analyzing user behavior patterns based on the behavior analysis results, wherein the user behavior patterns are used to monitor abnormal activities, trends, and correlations in the network; Through the user behavior pattern, the identity and behavior characteristics of the user are identified, the user's behavior is predicted, potential abnormal behavior and attack behavior are determined, and the monitoring result is generated.

Images