Data access control method and device, computer equipment and storage medium

Abstract

The invention discloses a data access control method and device, computer equipment and a storage medium, and the method comprises the steps: collecting access element data of an access request when the access request is received; determining a dynamic security risk value of the access request based on the access element data; determining an access authority and a supplementary authentication means of the access request according to the dynamic security risk value; and after the supplementary authentication means passes authentication, authorizing the access request to perform data access based on the access permission. Visibly, the access authority and the supplementary authentication means of the access request can be determined through the dynamic security risk value, so that the access request is authorized to perform data access after the supplementary authentication means is passed, a user verified by the supplementary authentication means can access sensitive data, unauthorized access and data leakage are effectively prevented, and the user experience is improved. And the security of identity management and access control is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a data access control method, device, computer equipment and storage medium. Background Art

[0002] In the digital age, identity management and access control technologies are undergoing major changes. With the rapid development of information technologies such as cloud computing, the Internet of Things, blockchain, 5G, and big data, identity and access management (IAM) technology is moving towards a service-oriented, intelligent, and dynamic direction. As an indispensable part of an enterprise's security plan, IAM not only helps prevent user credential leakage and password cracking, but also ensures business productivity and the smooth operation of digital systems.

[0003] However, the existing identity management and access control mechanisms are often completed through a combination of identity authentication and a simple access control list. After identity authentication, the effect of identifying risky access is not outstanding. Or authorization is performed based on the user's account. After obtaining the control rights corresponding to the account, malicious operations are performed using the access rights of the account without performing other authentication, which has low security. Summary of the invention

[0004] The present application proposes a data access control method, apparatus, computer equipment and storage medium to improve the security of identity management and access control.

[0005] In a first aspect, a data access control method is provided, comprising:

[0006] When receiving an access request, collecting access element data of the access request;

[0007] Determining a dynamic security risk value of the access request based on the access factor data;

[0008] Determining access rights and supplementary authentication means for the access request according to the dynamic security risk value;

[0009] After the supplementary authentication means passes authentication, the access request is authorized to access data based on the access authority.

[0010] In a second aspect, a data access control device is provided, comprising:

[0011] A collection module, used for collecting access element data of the access request when receiving the access request;

[0012] A first determination module, configured to determine a dynamic security risk value of the access request based on the access factor data;

[0013] A second determination module, configured to determine the access rights and supplementary authentication means of the access request according to the dynamic security risk value;

[0014] The authorization module is used to authorize the access request to access data based on the access permission after the supplementary authentication means passes the authentication.

[0015] Optionally, in some embodiments of the present application, the acquisition module includes:

[0016] The collection submodule is used to collect the access element data of the access request according to the data collection mode corresponding to the collection mode identifier if a collection mode identifier is received.

[0017] Optionally, in some embodiments of the present application, the device further includes:

[0018] A communication module, configured to establish a communication connection with the current login terminal based on the access request at each interval if the collection mode identifier is not received within a preset interval;

[0019] The third collection module is used to collect the access element data of the access request based on the traffic analysis collection mode if the number of communication connections reaches a preset number threshold and the collection mode identifier is still not received.

[0020] Optionally, in some embodiments of the present application, the first determining module includes:

[0021] The acquisition submodule is used to obtain vulnerability risk data and account risk data;

[0022] The calculation submodule is used to calculate the risk value of the access factor data based on the vulnerability risk data and the account risk data to obtain the dynamic security risk value of the access request.

[0023] Optionally, in some embodiments of the present application, the acquisition submodule includes:

[0024] An acquisition unit, used to acquire a first query interface set of the vulnerability risk data and a second query interface set of the account risk data;

[0025] A first collection unit, configured to collect the vulnerability risk data based on the first query interface set and a preset first collection time interval;

[0026] The second collection unit is used to collect the account risk data based on the second query interface set and a preset second collection time interval.

[0027] Optionally, in some embodiments of the present application, the access element data includes device elements, network elements and credential elements, and the calculation submodule includes:

[0028] A first calculation unit, configured to calculate a risk value based on the device element and the vulnerability risk data to obtain a vulnerability risk value;

[0029] A second calculation unit, configured to calculate a risk value based on the network elements and the vulnerability risk data to obtain a network risk value;

[0030] A product unit, used for producting the vulnerability risk value and the network risk value to obtain a device risk value;

[0031] A third calculation unit, configured to calculate a risk value based on the credential elements and the account risk data to obtain an account leakage risk value;

[0032] The fourth calculation unit is used to calculate the device risk value and the account leakage risk value to obtain the dynamic security risk value.

[0033] Optionally, in some embodiments of the present application, the device further includes:

[0034] An acquisition module, used for acquiring current access data of the access request;

[0035] A storage module is used to generate a current access tag based on the access tag corresponding to the current access data and the previous access data, and store the current access tag in the blockchain to synchronously update the tag ledgers of all nodes in the blockchain, and download the updated tag ledger to the current login terminal.

[0036] According to a third aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned data access control method when executing the computer program.

[0037] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned data access control method are implemented.

[0038] The present application provides a data access control method, device, computer equipment and storage medium, which collects the access element data of the access request when receiving the access request; determines the dynamic security risk value of the access request based on the access element data; determines the access permission and supplementary authentication means of the access request according to the dynamic security risk value; and authorizes the access request to access data based on the access permission after the supplementary authentication means is authenticated. In the data access control scheme provided by the present application, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access permission and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request will be authorized, allowing the user to access the data according to the assigned permissions. It can be seen that the access permission and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 An application environment diagram of the data access control method provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of the structure of the zero-trust architecture provided in the embodiment of the present application;

[0042] Figure 3 A flowchart of a data access control method provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of the process of storing and updating the current access tag provided in an embodiment of the present application;

[0044] Figure 5 A structural block diagram of a data access control device provided in an embodiment of the present application;

[0045] Figure 6 A structural block diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0048] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0049] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0050] The data access control method provided by the embodiment of the present invention can be applied in Figure 1In the application environment of . Among them, the computer device 110 communicates with the server 120 through the network 130. When receiving an access request, the computer device 110 can collect the access element data of the access request; determine the dynamic security risk value of the access request based on the access element data; determine the access right and supplementary authentication means of the access request according to the dynamic security risk value; after the supplementary authentication means is authenticated, authorize the access request to access data based on the access right. In the present invention, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access right and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request will be authorized, allowing the user to access the data according to the assigned authority. It can be seen that the access right and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control. Among them, the computer device 110 can be, but is not limited to, various smart phones 110-1, tablet computers 110-2 and laptop computers 110-3. The present invention is described in detail below through specific embodiments.

[0051] The data access control method provided by the embodiment of the present invention can be applied in Figure 2The zero-trust architecture shown in the figure includes an authentication factor collection module, which is used to collect the access factor data of the access request when receiving the access request; an authentication factor evaluation module, which is used to determine the dynamic security risk value of the access request based on the access factor data; then, the basic identity management module and the authority management module are deployed based on the different dynamic security risk values, and the identity management module determines the supplementary authentication means of the access request according to the dynamic security risk value, such as using multi-factor authentication methods of different complexity; the authority management module determines the access rights of the access request according to the dynamic security risk value, such as configuring different access rights, which can actively identify the risk of the access request, and control the user's access in real time according to the risk level of the user's identity authentication factor, so as to ensure the high security of identity authentication. After the general basic modules such as identity management and authority management, the access tag generation and recording module is placed. The access tag is generated based on blockchain technology. Different access tags will be generated for each access, and all access tags generated for this access will be on the same chain, which can effectively avoid tampering with the access record and provide effective traceability means. This zero-trust architecture uses an algorithm to calculate the authentication factor (access factor data) provided by the user during the user authentication stage, obtains the user's data security risk level on the Internet (i.e., dynamic security risk value), and dynamically controls user access based on the data security risk level, thereby improving the security of identity management and access control.

[0052] See also Figure 3 As shown, Figure 3 The present invention provides a flow chart of a data access control method. The method can be applied to both a terminal and a server. This embodiment is described by applying the method to the server. The data access control method includes the following steps:

[0053] S101: When receiving an access request, collecting access element data of the access request.

[0054] An access request is a request initiated by a user or system to a network, system, application, or service to obtain access rights to a specific resource. For example, in this application, an access request may be a request initiated to a business terminal to obtain access rights to data such as organizational information and data assets in the business terminal. An access request may be a request initiated to a business terminal after the account has been verified.

[0055] Access factor data may be data used to authenticate access requests. The access factor data includes access credentials, device elements, network elements, etc. Among them, device elements may include the hardware device used by the user when initiating the access request, such as a personal computer (PC), a laptop, a mobile phone, etc. Network elements may include the network environment in which the user initiates the access, such as a wired network, a wireless network, etc. Credential elements may include the credentials provided by the user when initiating the access, such as user name, password, mobile phone number, email address, etc.

[0056] In one embodiment, access factor data can be collected by using identity and access management (IAM) technology to collect any user's access to a network, system, application, or service in any network environment. For example, when a user attempts to access a resource, the IAM system first requires the user to provide identity credentials, such as a user name and password, a digital certificate, biometric information, etc.; and evaluates the environmental factors of the access request initiated by the user, including geographic location, network quality, timestamp, etc.

[0057] In one embodiment, the collecting of access factor data of the access request includes:

[0058] If a collection mode identifier is received, the access element data of the access request is collected according to the data collection mode corresponding to the collection mode identifier.

[0059] The collection mode identifier may be data or a signal that identifies a specific collection mode during data collection, and is transmitted from the initiator of the access request (i.e., the current login terminal) to the data collection processing terminal (i.e., the service terminal).

[0060] When a user attempts to access a resource, a risk assessment may be performed on the user's access request. At this time, a corresponding collection mode identifier may be sent to the data collection processing end to indicate the corresponding data collection mode of the data collection processing end.

[0061] In the proxy collection mode, data collection is completed through an intermediate proxy server. The intermediate proxy server acts as an intermediary between the current login terminal and the business terminal, and all inbound and outbound network traffic must pass through this proxy. The intermediate proxy server can monitor, record and analyze all traffic passing through it, including HTTP requests, file transfers, emails, etc. It can also check the content of the data packet and perform security checks such as virus scanning, malware detection, data leakage protection and other access element data.

[0062] Traffic parsing mode involves direct monitoring and analysis of network traffic. This traffic parsing mode usually relies on network monitoring tools such as network sniffers, intrusion detection systems (IDS), and network traffic analyzers. In this traffic parsing mode, the business terminal monitors the traffic on the network interface, captures the passing data packets, and parses the headers and contents of these data packets to extract useful information, such as source address, destination address, protocol type, port number, and other access element data.

[0063] For example, assuming that the data collection identifier includes MID x and 0, due to MID x Only exists in agent collection mode. When the evaluation process starts, if a message containing MID is received x If the data collection flag is 0, the access factor data of the access request is collected using the proxy collection mode; if the data collection flag is 0, the access factor data of the access request is collected using the traffic parsing mode.

[0064] In one embodiment, during the evaluation process, if the data collection identifier is 0, the access element data of the access request is collected using the traffic analysis mode, and then, if the MID is received, x If data is required, the mode switches to proxy collection mode to collect access element data for the access request.

[0065] In one embodiment, the method further comprises:

[0066] If the collection mode identifier is not received within a preset interval, then the communication connection is performed based on the current login terminal of the access request at each interval;

[0067] If the number of communication connections reaches a preset number threshold and the collection mode identifier is still not received, the access element data of the access request is collected based on the traffic analysis collection mode.

[0068] The preset interval time may be a time interval for determining the collection mode and sent by the current login terminal to the service terminal when the user initiates an access request.

[0069] For example, when an access request is received, a risk assessment of the access request is started. x If the access request is received, the preset interval time Tm is set. x The target identifier (i.e. MID) of the acquisition mode identifier was not received. x ), then Tm xAttempt to establish an agent communication connection with the client (i.e., the current login end of the access request) at a time interval; if the number of communication connections reaches the preset threshold (e.g., 3 times) and the target identifier is still not received, it will automatically switch to the traffic analysis collection mode to collect the access element data of the access request. The algorithm Modelpick of the judgment process of this data collection mode can be expressed as:

[0070]

[0071] S102: Determine a dynamic security risk value of the access request based on the access factor data.

[0072] The dynamic security risk value indicates the value actually calculated or evaluated during the process of requesting data access, and is used to indicate the security risk level of the access request.

[0073] After each access factor data is collected, the access factor data can be evaluated for risk value based on a preset risk assessment model, thereby determining the dynamic security risk value of the access request. The risk assessment model can be constructed based on statistical analysis, machine learning algorithms, and other methods.

[0074] In one embodiment, determining the dynamic security risk value of the access request based on the access factor data includes:

[0075] Obtain vulnerability risk data and account risk data;

[0076] A risk value is calculated for the access factor data based on the vulnerability risk data and the account risk data to obtain a dynamic security risk value of the access request.

[0077] Vulnerability risk data may be data related to security vulnerabilities in computer systems, networks, applications or devices, and is used to assess the vulnerability risk of access factor data. Account risk data may be security information and indicator data related to the user account corresponding to the access request, and is used to assess the security and potential risks of the user account.

[0078] You can regularly access public vulnerability databases on the Internet, such as the Common Vulnerabilities and Exposures (CVE) and the National Vulnerability Database (NVD), download the latest vulnerability data files, and synchronize the downloaded vulnerability data files with the local database or vulnerability management system on the business terminal, so that you can obtain vulnerability risk data from the local database or vulnerability management system.

[0079] You can regularly visit data leakage risk query sites, such as Have I Been Pwned (HIBP), download data leakage reports or databases, and parse the downloaded data leakage reports or databases into a structured format and integrate them with the existing account database on the business terminal (the existing account database may include account risk data collected from internal security logs, identity authentication systems, behavioral analysis systems, etc., including login anomalies, password leaks, illegal access attempts, etc.), so that you can obtain account risk data from the integrated account database.

[0080] Features of vulnerability risk data and account risk data can be extracted and classified (such as features corresponding to abnormal login behavior are classified into one category, and features corresponding to device security status are classified into another category), and then risk value assessment is performed on the classified feature data based on a pre-built risk assessment model to obtain a dynamic security risk value for the access request.

[0081] In one embodiment, the obtaining of vulnerability risk data and account risk data includes:

[0082] Obtain a first query interface set for the vulnerability risk data and a second query interface set for the account risk data;

[0083] Collecting the vulnerability risk data based on the first query interface set and a preset first collection time interval;

[0084] The account risk data is collected based on the second query interface set and a preset second collection time interval.

[0085] For example, assuming that the first query interface set is APId x , such as CVE, CNVD, CNNVD, etc., the first collection time interval is Td x , vulnerability risk data is represented as Dtd x . It can be based on the query interface API provided by various public vulnerability databases on the Internet x , use an algorithm (such as Python, Bash or other programming language script) according to the first collection time interval Td x Vulnerability data is collected from various public vulnerability databases and classified and updated regularly, so that vulnerability risk data can be obtained. The algorithm DGet for collecting vulnerability risk data can be expressed as:

[0086] DGet(APIdx, Tdx) = Dtdx

[0087] For example, assuming that the second query interface set is APIa x, such as FirefoxMonitor, HavelbeenPwned, Intelligence X, etc. The second collection time interval is Ta x , account risk data is Dta x , can be based on the query interface APIa provided by the Internet public data leakage risk query site x , use an algorithm (such as Python, Bash or other programming language script) according to the second collection time interval Ta x Account risk data is collected regularly from public data leakage risk query sites on the Internet and classified and updated to obtain account risk data. The algorithm ActGet for collecting account risk data can be expressed as:

[0088] ActGet(APIax, Tax) = Dtax

[0089] In one implementation, the access factor data includes a device factor, a network factor, and a credential factor, and the risk value calculation of the access factor data based on the vulnerability risk data and the account risk data to obtain the dynamic security risk value of the access request includes:

[0090] Calculate the risk value based on the device elements and the vulnerability risk data to obtain a vulnerability risk value;

[0091] Calculate the risk value based on the network elements and the vulnerability risk data to obtain a network risk value;

[0092] Calculating the product of the vulnerability risk value and the network risk value to obtain a device risk value;

[0093] Calculate the risk value based on the credential elements and the account risk data to obtain an account leakage risk value;

[0094] The device risk value and the account leakage risk value are calculated to obtain the dynamic security risk value.

[0095] Among them, the vulnerability risk value is used to indicate the vulnerability type of the device element (such as no vulnerability, common vulnerability, severe vulnerability). The network risk value is used to indicate the network type of the network element (such as internal network, external wired network, external wireless network). The device risk value is used to indicate the risk level of the current login terminal of the access request in the network environment.

[0096] The first risk assessment algorithm (such as the cosine similarity algorithm) collects the device elements and the vulnerability risk data Dtd x Compare and get the vulnerability risk value. For example, the device element and the vulnerability risk data Dtd x The comparison can be expressed as:

[0097]

[0098] Based on this, if the equipment element Eq x Vulnerability Risk Data Dtd x If the vulnerability risk value after comparison is 1, it means that the device element has no vulnerability; if the device element Eq x Vulnerability Risk Data Dtd x The vulnerability risk value after comparison is 0.7, which means that the device element has a common vulnerability; if the device element Eq x Vulnerability Risk Data Dtd x The vulnerability risk value after comparison is 0.40, which means that the device element has a serious vulnerability.

[0099] The second risk assessment algorithm (such as the cosine similarity algorithm) collects the network elements Net x Vulnerability Risk Data Dtd x The network risk value is obtained by comparison. For example, the device element Net x Vulnerability Risk Data Dtd x The comparison can be expressed as:

[0100]

[0101] Based on this, if the device element Net x Vulnerability Risk Data Dtd x If the network risk value after comparison is 1, it means that the network element is an internal network; if the device element Net x Vulnerability Risk Data Dtd x If the network risk value after comparison is 0.8, it means that the network element is an external wired network; if the device element Net x Vulnerability Risk Data Dtd x The network risk value after comparison is 0.30, which means that the network element is an external wireless network.

[0102] Then, by applying DNetAss(Eq x ,Dtd x ) and DNetAss(Net x ) is multiplied (such as weighted summation) to obtain the equipment risk value. For example, DNetAss (Eq x ,Dtd x ) and DNetAss(Net x ) to obtain the equipment risk value, which can be expressed as:

[0103] Rkdn=∏DNetAss(Eqx,Dtdx)

[0104] According to the device risk value Rkdn, the risk level of the current login terminal of the access request in the network environment can be determined. For example, assuming that the risk level of the device risk value DNetAss (Net x ) is expressed as:

[0105]

[0106] Based on this, if the device risk value is in the range of 1.00 to 0.75, it means that the network of the current logged-in device is an internal network and has no vulnerabilities; if the device risk value is in the range of 0.75 to 0.50, it means that the network of the current logged-in device is an external wired network and has ordinary vulnerabilities; if the device risk value is in the range of 0.50 to 0.25, it means that the network of the current logged-in device is an external wireless network and has serious vulnerabilities; if the device risk value is in the range of 0.25 to 0.00, it means that the network of the current logged-in device is an external wireless network and has high-risk vulnerabilities.

[0107] Among them, the credential element Act x Including but not limited to user name, email address, password, mobile phone number and other elements, namely Act x Including uname, email, pwd, phone and other elements, using the third risk assessment algorithm (such as cosine similarity) to convert the credential element Act x and account risk data Dta x Calculate the risk value and get the account leakage risk value. x and account risk data Dta x After calculating the risk value, the account leakage risk value Rka can be expressed as:

[0108]

[0109] Based on this, if the account leakage risk value Rka is 1, it means that there is no leakage of the credential element; if the account leakage risk value Rka is 0.75, it means that 1 credential in the credential element has been leaked; if the account leakage risk value Rka is 0.50, it means that 2 credentials in the credential element have been leaked; if the account leakage risk value Rka is 0.25, it means that more than 2 credentials in the credential element have been leaked.

[0110] The device risk value Rkdn and the account leakage risk value Rka are calculated by a comprehensive assessment algorithm to obtain a dynamic security risk value. For example, the comprehensive assessment algorithm TotalAss can be expressed as:

[0111]

[0112] Among them, Rkdn xIndicates the risk value of the x-th device Rkdn, Rka x Rka represents the leakage risk value of the x-th account, and Rkt is the dynamic security risk value of the access request.

[0113] The higher the dynamic security risk value is, the higher the access risk of the access request is; conversely, the lower the access risk of the access request is. When the dynamic security risk value is lower than a certain risk threshold, it means that the access request is risk-free.

[0114] S103: Determine the access rights and supplementary authentication means of the access request according to the dynamic security risk value.

[0115] The dynamic security risk value Rkt can be calculated by the supplementary authentication algorithm AnoSign to obtain the supplementary authentication means of the access request. The corresponding supplementary authentication means can also be obtained through the dynamic risk value. The higher the risk value, the more supplementary authentication means are required. For example, when the dynamic security risk value is 0.9, it indicates a high risk, and additional authentication means such as user name, password, OTP, and biometric authentication are required, and manual review by the security team is required. The supplementary authentication algorithm AnoSign can be expressed as:

[0116] SignList = AnoSign (Rkt)

[0117] Among them, SignList represents a list of supplementary authentication means.

[0118] The dynamic security risk value Rkt can be calculated by the access control algorithm AcCtr to obtain the access rights of the access request. The corresponding access rights can also be obtained through the dynamic risk value. The higher the risk value, the lower the access rights. For example, when the dynamic security risk value is 0.9, it indicates a high risk, and the user's access request is prohibited, and the account is locked until the user passes the supplementary authentication method before data access can be performed. The access control algorithm AcCtr can be expressed as:

[0119] AclList=AcCtr(Rkt)

[0120] Among them, AclList represents the access permission list.

[0121] S104: After the supplementary authentication means passes authentication, authorize the access request to access data based on the access permission.

[0122] After the user has authenticated all supplementary authentication methods, data can be accessed within the scope of access permission restrictions.

[0123] For example, assuming that the supplementary authentication means include entering a password; providing a one-time password (OTP), which is generated by the user's mobile phone application; and performing biometric authentication, such as fingerprint scanning; then when the supplementary authentication means are all passed, the authorized user can access data within the access rights.

[0124] Optionally, after the supplementary authentication means are passed, the dynamic security risk value can be adjusted (eg, reduced to medium risk), and the user's access rights can be adjusted according to the adjusted dynamic security risk value.

[0125] In one embodiment, the method further comprises:

[0126] Obtaining current access data of the access request;

[0127] A current access tag is generated based on the access tag corresponding to the current access data and the last access data, and the current access tag is stored in the blockchain to synchronously update the tag ledgers of all nodes in the blockchain, and the updated tag ledger is downloaded to the current login terminal.

[0128] Among them, the current access data includes the current timestamp tst of the access request and the access process data data (such as access factor data, supplementary authentication means, access rights, etc.).

[0129] The current access data in the access request data access control process can be recorded and stored in real time, so that the current access data can be obtained.

[0130] The access tag preBlock corresponding to the last access data refers to the last access tag of the account corresponding to the access request.

[0131] The blockchain-based tag generation algorithm calculates the current access data and the previous access tag preBlock to generate the current access tag, and stores the current access tag in the blockchain and the current login terminal. Specifically, the SHA256 encryption algorithm can be used to encrypt the final current access tag. The current access tag block generation algorithm expression is:

[0132] block=SHA256(buildBlock(tst,preBlock,data))

[0133] After the current access tag is generated, the tag ledger will be synchronized, stored and updated with the access terminal (i.e. the current login terminal). Figure 4First, the synchronization of the tag book occurs before the current access request is initiated. Only after the tag book synchronization verification is correct can the next authentication and access (i.e., the data access control process of this application) be performed. For the agent collection mode, the tag book will be downloaded to the access terminal and saved locally when the agent is installed and deployed. After the access terminal installs the agent, it can communicate with the synchronization server (i.e., the business terminal) at regular intervals to update the local tag book of the current login terminal. Before authentication and access, it is only necessary to verify whether the tag book exists in the current login terminal and whether the tag book is valid. For the traffic analysis collection mode, when the access terminal (i.e., the current login terminal) is accessed for the first time, it is necessary to obtain the tag book through other means such as contacting the administrator to upload it to the synchronization server (i.e., the business terminal) for comparison. Only after the comparison is passed can authentication and access operations (i.e., the data access control process of this application) be performed; when the dynamic evaluation is completed (i.e., after the data access control process of this application is completed), the latest tag book will be downloaded to the access terminal, so that when the access terminal is not accessed for the first time, the tag book in the local area can be directly uploaded to the synchronization server for comparison. It should be noted that after the dynamic data risk assessment (i.e. after the data access control process of this application is completed), a current access tag will be generated to mark the access regardless of whether the user successfully accesses it. The current access tag is generated based on blockchain technology. The current access tags of all users will be stored in an optimized, compressed, and encrypted blockchain ledger, and each user has a complete tag ledger. In the data access control process, blockchain technology and algorithms are used to generate an undeniable and traceable current access tag for the data access control process. In addition, dynamic and more secure authentication and access control can be achieved.

[0134] The above is the data access control process of this application.

[0135] As mentioned above, the present application provides a data access control method, device, computer equipment and storage medium, by collecting the access element data of the access request when receiving the access request; determining the dynamic security risk value of the access request based on the access element data; determining the access permission and supplementary authentication means of the access request according to the dynamic security risk value; after the supplementary authentication means is authenticated, authorizing the access request to access the data based on the access permission. In the data access control scheme provided by the present application, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access permission and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request will be authorized, allowing the user to access the data according to the assigned permissions. It can be seen that the access permission and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control.

[0136] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0137] In one embodiment, a data access control device is provided, which corresponds one-to-one to the data access control method in the above embodiment. Figure 5 As shown, the data access control device includes:

[0138] The collection module 201 is used to collect access element data of the access request when receiving the access request;

[0139] A first determination module 202, configured to determine a dynamic security risk value of the access request based on the access factor data;

[0140] A second determination module 203, configured to determine the access rights and supplementary authentication means of the access request according to the dynamic security risk value;

[0141] The authorization module 204 is used to authorize the access request to access data based on the access permission after the supplementary authentication means is authenticated.

[0142] In the data access control scheme provided by the present application, when receiving an access request, the access element data of the access request is collected; the dynamic security risk value of the access request is determined based on the access element data; the access permission and supplementary authentication means of the access request are determined according to the dynamic security risk value; after the supplementary authentication means is authenticated, the access request is authorized to access data based on the access permission. In the data access control scheme provided by the present application, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access permission and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request is authorized, allowing the user to access the data according to the assigned permissions. It can be seen that the access permission and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control.

[0143] Optionally, in some embodiments of the present application, the acquisition module includes:

[0144] The collection submodule is used to collect the access element data of the access request according to the data collection mode corresponding to the collection mode identifier if a collection mode identifier is received.

[0145] Optionally, in some embodiments of the present application, the device further includes:

[0146] A communication module, configured to establish a communication connection with the current login terminal based on the access request at each interval if the collection mode identifier is not received within a preset interval;

[0147] The third collection module is used to collect the access element data of the access request based on the traffic analysis collection mode if the number of communication connections reaches a preset number threshold and the collection mode identifier is still not received.

[0148] Optionally, in some embodiments of the present application, the first determining module includes:

[0149] The acquisition submodule is used to obtain vulnerability risk data and account risk data;

[0150] The calculation submodule is used to calculate the risk value of the access factor data based on the vulnerability risk data and the account risk data to obtain the dynamic security risk value of the access request.

[0151] Optionally, in some embodiments of the present application, the acquisition submodule includes:

[0152] An acquisition unit, used to acquire a first query interface set of the vulnerability risk data and a second query interface set of the account risk data;

[0153] A first collection unit, configured to collect the vulnerability risk data based on the first query interface set and a preset first collection time interval;

[0154] The second collection unit is used to collect the account risk data based on the second query interface set and a preset second collection time interval.

[0155] Optionally, in some embodiments of the present application, the access element data includes device elements, network elements and credential elements, and the calculation submodule includes:

[0156] A first calculation unit, configured to calculate a risk value based on the device element and the vulnerability risk data to obtain a vulnerability risk value;

[0157] A second calculation unit, configured to calculate a risk value based on the network elements and the vulnerability risk data to obtain a network risk value;

[0158] A product unit, used for producting the vulnerability risk value and the network risk value to obtain a device risk value;

[0159] A third calculation unit, configured to calculate a risk value based on the credential elements and the account risk data to obtain an account leakage risk value;

[0160] The fourth calculation unit is used to calculate the device risk value and the account leakage risk value to obtain the dynamic security risk value.

[0161] Optionally, in some embodiments of the present application, the device further includes:

[0162] An acquisition module, used for acquiring current access data of the access request;

[0163] A storage module is used to generate a current access tag based on the access tag corresponding to the current access data and the previous access data, and store the current access tag in the blockchain to synchronously update the tag ledgers of all nodes in the blockchain, and download the updated tag ledger to the current login terminal.

[0164] In one embodiment, a computer device is provided, the internal structure diagram of which can be as follows: Figure 6As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, it implements the functions or steps of a data access control method.

[0165] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0166] When an access request is received, access element data of the access request is collected; a dynamic security risk value of the access request is determined based on the access element data; access rights and supplementary authentication means of the access request are determined according to the dynamic security risk value; after the supplementary authentication means is authenticated, the access request is authorized to access data based on the access rights.

[0167] In this embodiment, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access rights and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request will be authorized, allowing the user to access the data according to the assigned permissions. It can be seen that the access rights and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control.

[0168] In one embodiment, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0169] When an access request is received, the access element data of the access request is collected; the dynamic security risk value of the access request is determined based on the access element data; the access rights and supplementary authentication means of the access request are determined according to the dynamic security risk value; after the supplementary authentication means is authenticated, the access request is authorized to access data based on the access rights.

[0170] In this embodiment, the security risk value is dynamically evaluated by collecting the element data of the access request, and the access rights and the required supplementary authentication means are determined accordingly. Only when the supplementary authentication is successfully passed, the access request will be authorized, allowing the user to access the data according to the assigned permissions. It can be seen that the access rights and supplementary authentication means of the access request can be determined by the dynamic security risk value, so that after the supplementary authentication means is passed, the access request is authorized to access the data, ensuring that only users verified by the supplementary authentication means can access sensitive data, thereby effectively preventing unauthorized access and data leakage, and improving the security of identity management and access control.

[0171] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0172] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0173] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0174] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A data access control method, characterized in that: include: When receiving an access request, collecting access element data of the access request; Determining a dynamic security risk value of the access request based on the access factor data; Determining access rights and supplementary authentication means for the access request according to the dynamic security risk value; After the supplementary authentication means passes authentication, the access request is authorized to access data based on the access authority.

2. The data access control method according to claim 1, characterized in that: The collecting of the access element data of the access request includes: If a collection mode identifier is received, the access element data of the access request is collected according to the data collection mode corresponding to the collection mode identifier.

3. The data access control method according to claim 2, characterized in that: The method further comprises: If the collection mode identifier is not received within a preset interval, then communicating and connecting with the current login terminal based on the access request at each interval; If the number of communication connections reaches a preset number threshold and the collection mode identifier is still not received, the access element data of the access request is collected based on the traffic analysis collection mode.

4. The data access control method according to claim 1, characterized in that: The determining the dynamic security risk value of the access request based on the access factor data includes: Obtain vulnerability risk data and account risk data; A risk value is calculated for the access factor data based on the vulnerability risk data and the account risk data to obtain a dynamic security risk value of the access request.

5. The data access control method according to claim 4, characterized in that: The obtaining of vulnerability risk data and account risk data includes: Obtain a first query interface set for the vulnerability risk data and a second query interface set for the account risk data; Collecting the vulnerability risk data based on the first query interface set and a preset first collection time interval; The account risk data is collected based on the second query interface set and a preset second collection time interval.

6. The data access control method according to claim 4, characterized in that: The access element data includes a device element, a network element, and a credential element, and the risk value calculation of the access element data based on the vulnerability risk data and the account risk data to obtain the dynamic security risk value of the access request includes: Calculate the risk value based on the device elements and the vulnerability risk data to obtain a vulnerability risk value; Calculate the risk value based on the network elements and the vulnerability risk data to obtain a network risk value; Calculating the product of the vulnerability risk value and the network risk value to obtain a device risk value; Calculate the risk value based on the credential elements and the account risk data to obtain an account leakage risk value; The device risk value and the account leakage risk value are calculated to obtain the dynamic security risk value.

7. The data access control method according to claim 1, characterized in that: The method further comprises: Obtaining current access data of the access request; A current access tag is generated based on the access tag corresponding to the current access data and the last access data, and the current access tag is stored in the blockchain to synchronously update the tag ledgers of all nodes in the blockchain, and the updated tag ledger is downloaded to the current login terminal.

8. A data access control device, characterized in that: include: A collection module, used for collecting access element data of the access request when receiving the access request; A first determination module, configured to determine a dynamic security risk value of the access request based on the access factor data; A second determination module, configured to determine the access rights and supplementary authentication means of the access request according to the dynamic security risk value; The authorization module is used to authorize the access request to access data based on the access permission after the supplementary authentication means passes the authentication.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the data access control method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the data access control method according to any one of claims 1 to 7 are implemented.

Images