Access control method, device, equipment, medium and program product

Abstract

The invention provides an access control method and device, equipment, a medium and a program product, and the method comprises the steps: obtaining a data attribute of a business system in a client in response to an operation request of the client, determining a user type of a user of the business system, and when the user type is a data provider, sending the data to the client; and storing first target data obtained from the client to the target trusted data space based on the data attribute, generating an operation log, sending second target data obtained from the target trusted data space to the client based on the data attribute under the condition that the user type is a data user side, generating an operation log, and sending the operation log to the client. And under the condition that the operation log is not empty, performing risk analysis on the operation log by utilizing a preset behavior analysis model to judge whether the operation behavior of the current user meets a preset risk condition, and if the operation behavior of the current user meets the preset risk condition, executing an adjustment operation on the data attribute to reduce the risk. The automation degree of data security management can be enhanced.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and specifically to an access control method, device, equipment, medium and program product. Background Art

[0002] With the in-depth development of new-generation information technology, the safe circulation and sharing of data has received extensive attention. Since traditional technical means cannot take into account the needs of user identity authentication, data content protection, data use control, etc., data providers and users have a series of problems such as being unable to circulate, unwilling to circulate, and unable to circulate. Data providers are worried that after data circulation and sharing, they will encounter illegal use behaviors such as data duplication, unauthorized use, and secondary circulation. The willingness to circulate and share data is low and the concerns are great, which hinders the development of the data market.

[0003] Based on the above data usage issues, it is proposed to use trusted data space to promote the compliant and efficient circulation and use of data elements, and accelerate the construction of a digital economy with data as the key element. However, in the process of using trusted data space, the data security in the trusted data space cannot be guaranteed. Summary of the invention

[0004] The present application proposes an access control method to address the deficiencies of the above-mentioned prior art.

[0005] In the first aspect, an embodiment of the present application provides an access control method, which is applied to a server, comprising: in response to an operation request for a target trusted data space sent by a client, obtaining data attributes of a business system in the client, and determining a user type of a current user of the business system, wherein the user type includes a data provider or a data user; when the user type of the current user is a data provider, based on the data attributes, storing the first target data obtained from the client to the target trusted data space, and generating an operation log; when the user type of the current user is a data user, based on the data attributes, sending the second target data obtained from the target trusted data space to the client, and generating an operation log; when the operation log is not empty, using a preset behavior analysis model, performing a risk analysis on the operation log to determine whether the operation behavior of the current user meets the preset risk conditions; if the risk analysis result is that the operation behavior of the current user meets the preset risk conditions, performing an adjustment operation on the data attributes.

[0006] In some embodiments of the present application, the method further includes: generating a target quantum key; decrypting the first target data obtained from the client based on the target quantum key before storing the first target data in the target trusted data space; and encrypting the second target data obtained from the target trusted data space based on the target quantum key before sending the second target data to the client.

[0007] In some embodiments of the present application, before obtaining the data attributes of the business system in the client and determining the user type of the current user of the business system, the method also includes: determining the user identity information of the current user of the business system according to the access request; judging whether the current user has access rights to the target trusted data space according to the user identity information; if the judgment result is yes, executing the steps of obtaining the data attributes of the business system in the client and determining the user type of the current user of the business system.

[0008] In some embodiments of the present application, when the user type is a data provider, the method further includes: obtaining a first target data attribute in the access request; decrypting the first target data attribute based on the target quantum key; if the decrypted first target data attribute is inconsistent with the data attribute, updating the data attribute to the first target data attribute.

[0009] In some embodiments of the present application, it also includes: in response to a message returned by the client indicating that the second target data is successfully received, obtaining a second target data attribute of the second target data; and updating the data attribute based on the second target data attribute.

[0010] In some embodiments of the present application, the data attributes include any one or more of the following: data content, data format, number of data usage, data usage time, data usage location, data usage scenario, business application to which the data belongs, role of the client, and client's operating permissions on the data.

[0011] In some embodiments of the present application, it also includes: storing the operation log in the blockchain network.

[0012] In some embodiments of the present application, it also includes: checking whether the operation log complies with the business logic of the business system; if the operation log does not comply with the business logic of the business system, generating a warning message for prompting the client of access abnormality; and sending the warning message to the client.

[0013] In the second aspect, an embodiment of the present application provides an access control device, including: a first acquisition module, used to respond to an access request for accessing a target trusted data space sent by a client, obtain the current data attributes of data in the business system in the client, and determine the user type of the current user of the business system, the user type including a data provider or a data user; a storage module, used to store the first target data obtained from the client to the target trusted data space based on the data attributes when the user type is a data provider, and generate an operation log; a second acquisition module, used to send the second target data obtained from the target trusted data space to the client based on the data attributes when the user type is a data user, and generate an operation log; an analysis and judgment module, used to perform a risk analysis on the operation log using a preset behavior analysis model to determine whether the operation behavior of the current user meets the preset risk conditions when the operation log is not empty; an adjustment module, used to perform an adjustment operation on the data attributes if the risk analysis result is that the operation behavior of the current user meets the preset risk conditions.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method described in the first aspect above is implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect above is implemented.

[0016] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, wherein the computer program is executed by a processor to implement the method described in the first aspect above.

[0017] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0018] The access control method of the embodiment of the present application is applied to the server. The server obtains the data attributes of the business system in the client and determines the user type of the current user of the business system by responding to the operation request for the target trusted data space sent by the client. The user type includes a data provider or a data user. When the user type of the current user is a data provider, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated. When the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated. This can improve the security of data in the target trusted data space, prevent unauthorized access and port scanning attacks, and reduce potential security risks during the data management process of multiple target trusted data spaces.

[0019] When the operation log is not empty, the preset behavior analysis model is used to perform risk analysis on the operation log to determine whether the current user's operation behavior meets the preset risk conditions. If the risk analysis result shows that the current user's operation behavior meets the preset risk conditions, the data attributes are adjusted to reduce data risks. By analyzing these operation logs, abnormal behaviors or potential security threats in the process of accessing the target trusted data space can be discovered in a timely manner, so that corresponding protective measures can be taken to improve the security of data in the target trusted data space. In addition, as the client's needs and behavior patterns change, the dynamic permission adjustment mechanism based on the risk analysis results can flexibly adjust the data attribute settings according to changes in real-time data and user behavior, thereby improving the management and control flexibility of the target trusted data space. Moreover, by limiting the client's data attribute permissions, the risk of data leakage or damage caused by misoperation can be reduced. At the same time, the dynamic permission adjustment mechanism based on the operation log can also predict and prevent potential misoperations based on the user's historical operation records and behavior patterns, further improving the security of data in the target trusted data space.

[0020] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0022] Figure 1 An architecture diagram of a trusted data space management and control system provided in an embodiment of the present application is shown;

[0023] Figure 2 A flowchart of an access control method provided by an embodiment of the present application is shown;

[0024] Figure 3 A business flow chart of an access control method provided by an embodiment of the present application is shown;

[0025] Figure 4 A schematic diagram of the structure of an access control device provided in an embodiment of the present application is shown;

[0026] Figure 5 A schematic diagram showing the structure of another access control device provided in an embodiment of the present application is shown;

[0027] Figure 6 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0029] With the in-depth development of new-generation information technology, the safe circulation and sharing of data has received extensive attention. Since traditional technical means cannot take into account the needs of user identity authentication, data content protection, data use control, etc., data providers and users have a series of problems such as being unable to circulate, unwilling to circulate, and unable to circulate. Data providers are worried that after data circulation and sharing, they will encounter illegal use behaviors such as data duplication, unauthorized use, and secondary circulation. The willingness to circulate and share data is low and the concerns are great, which hinders the development of the data market.

[0030] Based on the above data usage issues, it is proposed to use trusted data space to promote the compliant and efficient circulation and use of data elements, and accelerate the construction of a digital economy with data as the key element. However, in the process of using trusted data space, the data security in the trusted data space cannot be guaranteed.

[0031] In the prior art, traditional data encryption algorithms such as RSA (Rivest-Shamir-Adleman) or AES (Advanced Encryption Standard) are generally used. However, traditional data encryption algorithms are easily cracked when facing potential quantum computing threats and cannot protect data security well.

[0032] Furthermore, network attack technologies are constantly being updated, such as man-in-the-middle attacks and DDoS (Distributed Denial of Service) attacks. Traditional security measures are difficult to quickly defend against, which may cause serious problems such as data loss and decreased customer trust.

[0033] Based on this, an embodiment of the present application provides an access control method. The access control method responds to an operation request for a target trusted data space sent by a client on the server side, obtains data attributes of a business system in the client, and determines the user type of the current user of the business system, which includes a data provider or a data user. When the user type of the current user is a data provider, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated. When the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated. When the operation log is not empty, a preset behavior analysis model is used to perform a risk analysis on the operation log to determine whether the operation behavior of the current user meets the preset risk conditions. If the risk analysis result shows that the operation behavior of the current user meets the preset risk conditions, an adjustment operation is performed on the data attributes to reduce the data risk.

[0034] Through the access control method provided in the embodiment of the present application, the server implements the storage of the first target data obtained from the client to the target trusted data space based on the data attributes when the user type of the current user is a data provider, generates an operation log, and can store the data in the trusted data space. Through strict security measures and privacy protection mechanisms, data leakage and illegal access can be prevented, thereby ensuring the confidentiality and integrity of the data. Moreover, the target trusted data space can provide an efficient data circulation pipeline, so that data can be quickly and securely transmitted and shared between different participating entities, avoiding the cumbersome steps and inefficiencies in the traditional data flow process.

[0035] Furthermore, when the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated. The data can be defined and controlled in multiple dimensions according to its attributes and usage scenarios, helping both data supply and demand parties to form digital contracts and maximize the value of data. Moreover, the target trusted data space can help the client's business system better comply with the requirements of relevant laws and regulations and reduce compliance risks. The data user can also quickly and accurately obtain the required data, which can improve work efficiency and service quality, thereby optimizing the user experience. In addition, based on the operation logs generated by data management operations, a preset behavior analysis model is used to perform risk analysis on the operation logs to determine whether the current user's operation behavior meets the preset risk conditions. If the risk analysis result shows that the current user's operation behavior meets the preset risk conditions, the data attributes are adjusted to reduce data risks. By analyzing these operation logs, abnormal behaviors or potential security threats in the process of accessing the target trusted data space can be discovered in a timely manner, so that corresponding protective measures can be taken to improve the security of data in the target trusted data space. In addition, as the client's needs and behavior patterns change, the dynamic permission adjustment mechanism based on the operation log can flexibly adjust the permission settings according to changes in real-time data and user behavior, thereby improving the management and control flexibility of the target trusted data space. Moreover, by limiting the data attributes of the client's data, the risk of data leakage or damage caused by misoperation can be reduced. At the same time, the dynamic permission adjustment mechanism based on the operation log can also predict and prevent potential misoperations based on the user's historical operation records and behavior patterns, further improving the security of data in the target trusted data space.

[0036] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0037] Figure 1 The network architecture diagram based on the network security operation and maintenance method provided in the embodiment of the present application includes a server and a client. The client is connected to the server through a network. The server can be a single server, a server cluster consisting of multiple servers, or a cloud server. The client can be a user's mobile phone, smart watch, tablet computer, laptop computer, desktop computer, smart TV, wearable device, smart furniture and other devices, or the client can also be an application installed on these devices for access.

[0038] In actual applications, a suitable deployment mode and resource configuration can be selected for the server in advance according to the business needs of the client, wherein the resource configuration may include computing resources, storage resources, and network resources, etc. The deployment mode may be a public cloud or hybrid cloud mode. This application embodiment is not specifically limited.

[0039] The server of this application allows for automatic and rapid increase or decrease of resources according to the real-time requirements of the client, ensuring that the server can handle a large number of access requests during peak traffic and save costs during low client access demand.

[0040] Furthermore, the server in the present application can also dynamically adjust resource configuration according to the actual needs and access volume of the client, thereby achieving efficient resource utilization.

[0041] Then, through multi-region deployment and load balancing mechanisms, the redundancy and availability of the server are improved to ensure rapid recovery in the event of a failure.

[0042] The server of this application allows for automatic and rapid increase or decrease of resources according to the real-time requirements of the client, ensuring that the server can handle a large number of access requests during peak traffic and save costs during low client access demand.

[0043] After the server is deployed, the server can respond to the operation request for the target trusted data space sent by the client, obtain the data attributes of the business system in the client, and determine the user type of the current user of the business system. The user type includes a data provider or a data user. When the user type of the current user is a data provider, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated. When the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated. When the operation log is not empty, a preset behavior analysis model is used to perform a risk analysis on the operation log to determine whether the current user's operation behavior meets the preset risk conditions. If the risk analysis result is that the current user's operation behavior meets the preset risk conditions, an adjustment operation is performed on the data attributes to reduce data risks.

[0044] Figure 2 This is a flowchart of an access control method shown in some embodiments of the present application, which is used for the above-mentioned server, such as Figure 2 As shown, the method specifically comprises the following steps:

[0045] Step 101: The server obtains data attributes of the business system in the client in response to an operation request for a target trusted data space sent by the client, and determines the user type of the current user of the business system, where the user type includes a data provider or a data user.

[0046] In the embodiment of the present application, the target trusted data space is a new type of digital infrastructure that provides a security and trust mechanism for the cross-organizational circulation and use of data. It is in a distributed form, based on the existing data management system and network, and ensures the controlled and trusted circulation and application of data through systematic technical arrangements such as common standards and certifications, solves the security and trust issues between data element providers, users, service providers and other entities, and thus supports data-driven digital transformation. In addition, the target trusted data space constructs a "use-and-burn" space for data circulation and use, in which data will be forcibly deleted after use, thereby avoiding data retention, uncontrolled copying, dissemination and abuse.

[0047] In an embodiment of the present application, data attributes may refer to data attributes of data in a target trusted data space made by a data provider and a data user after prior negotiation. Specifically, the data attributes may include any one or more of the following: data content, data format, number of times the data is used, data usage time, data usage location, data usage scenario, the business application to which the data belongs, the client to which the data belongs, the role to which the client belongs, and the client's operating rights over the data. The operating rights may include operations such as adding, deleting, modifying, and querying the data.

[0048] By first obtaining the data attributes of the business system in the client, the data provider can provide the data to the data user only when it is necessary for the data user to use it, so that the data user can use the data in the target trusted data space according to the data attributes, which greatly ensures the security of the data and the traceability of the data, so that data usage disputes, quality traceability, data measurement and data supervision are effectively guaranteed.

[0049] In the embodiment of the present application, the data provider may refer to the entity that provides data resources in the target trusted data space, and has the right to determine the access, sharing and use rights of other participants to its data, and has the right to share the corresponding rights and interests according to the agreement after the data creates value.

[0050] Data users may refer to entities that use data resources in the target trusted data space, and process and use data resources, data products and services in accordance with the agreement signed with the target trusted data space operator, data provider, etc.

[0051] Based on the above implementation, in some modified implementations, before the server obtains the data attributes of the business system in the client and determines the user type of the current user of the business system, the server may also determine the user identity information of the current user of the business system according to the operation request, and determine whether the current user has access rights to the target trusted data space based on the user identity information. If the judgment result is yes, the steps of obtaining the data attributes of the business system in the client and determining the user type of the current user of the business system are executed.

[0052] By pre-verifying user identity information, we ensure that only users with corresponding permissions can access the target trusted data space, effectively preventing unauthorized access and potential data leakage risks. Authentication is performed immediately when the user initiates an operation request, which can reduce the number of permission checks in subsequent operations and improve the response speed and user experience of the server. Through strict user identity authentication and permission control, the target trusted data space can better comply with relevant laws and regulations and reduce compliance risks.

[0053] On the basis of the above implementation manner, in some modified implementation manners, the server determines whether the current user has access rights to the target trusted data space based on the user identity information. Specifically, the authentication method of the user identity information can be obtained, and the authentication method can include one or more authentications of fingerprints, voiceprints, encrypted passwords, irises, facial features, veins, human eyes, geographic locations, and palm prints. Then, based on the authentication method, the authentication information corresponding to the authentication method is obtained. The authentication information can be used to characterize the username and password of the requesting user, and then determine whether the user's username and password are consistent with the preset username and password. If the username and password are consistent with the preset username and password, the authentication is passed, and it is considered that the current user has access rights to the target trusted data space.

[0054] By using multi-factor authentication on the server side and adopting one or more authentication methods to authenticate the user's identity, the security of the user account can be significantly improved, the threat of identity theft and data theft can be greatly reduced, and identity theft can be effectively prevented, thereby increasing the security of data in the target trusted data space.

[0055] Based on the above implementation, in some modified implementations, the server can also be configured with single sign-on authentication, that is, the user's identity information is authenticated through single sign-on. After the authentication is passed, the business applications of other clients related to the identity can use the data of the target trusted data space without repeated identity authentication.

[0056] By configuring single sign-on authentication on the server, it is possible to simplify the tedious steps of repeatedly entering user names and passwords when multiple users of different business applications use data in the target trusted data space. Users can access the data of the required applications and services more quickly without spending time entering credentials on multiple login pages, thereby improving user work efficiency and productivity.

[0057] Step 102: When the user type of the current user is a data provider, the server stores the first target data obtained from the client into the target trusted data space based on the data attribute, and generates an operation log.

[0058] In one possible implementation of the embodiment of the present application, the server can, when the user type is a data provider, obtain a data packet in an operation request, the data packet includes the first target data, and then cleanse the first target data according to the data attributes, and store the cleaned first target data in the target trusted data space.

[0059] It should be noted that data cleaning can refer to adjusting the first target data to meet the format requirements specified by the data attributes. For example, the data attributes can specify that the data format of the first target data of business system A is JSON format, the number of times the data is used is 30 times, and the location of data use is Shanghai, Beijing, Tianjin, etc.

[0060] Furthermore, the first target data is data encrypted using a target quantum key.

[0061] Based on the above implementation, in some modified implementations, the server can use quantum key generation technology to generate a target quantum key, and then decrypt the first target data in the data packet based on the target quantum key, and finally, based on the data attributes, store the decrypted first target data in the target trusted data space.

[0062] It should be noted that quantum key generation technology may include photon polarization, entangled photon pairs, and continuous variable quantum key distribution (CV-QKD) and other technologies. This application embodiment does not specifically limit this.

[0063] On the basis of the above implementation manner, in some modified implementation manners, a data communication channel can be established between the server and the client, and based on the data communication channel, a target quantum key can be generated for the access request using quantum key generation technology. Specifically, a first quantum key can be generated for the access request based on a first preset measurement basis, and then sent to the client. The first quantum key can include multiple first quantum bits, and a second quantum key sent by the client is received. The second quantum key can be obtained by the client measuring the first quantum key based on a second preset measurement basis. The second quantum key includes multiple second quantum bits, and multiple target quantum bits with the same value as each first quantum bit and each second quantum bit are respectively obtained, and each target quantum bit is combined to form the target quantum key.

[0064] It should be noted that the first preset measurement basis vector and the second preset measurement basis vector can be measurement basis vectors pre-set by technical personnel in the field according to needs, or can be measurement basis vectors obtained by technical personnel in the field after adjusting the set measurement basis vectors according to actual needs. The embodiments of the present application do not make specific limitations.

[0065] Quantum encryption technology can detect any third party's attempt to obtain the target quantum key, improving the timeliness of detecting data attacks. Unlike traditional public key cryptography based on mathematical problems, the security of quantum encryption relies on the basic theory of quantum mechanics and can provide provable security based on information theory, which means that its security does not rely on assumptions about computational complexity, but is based on the laws of physics, making the data in the target trusted data space more secure.

[0066] By using the target quantum key to encrypt and decrypt the first target data, the security of the data can be greatly improved. Since the target quantum key is highly random and unpredictable, it is extremely difficult to crack, thereby effectively protecting the confidentiality and integrity of the first target data.

[0067] Furthermore, the server can control access to the decrypted first target data according to data attributes, which means that only clients with corresponding permissions can access and use the data, thereby ensuring the compliance and security of data use.

[0068] Furthermore, by storing the first target data in the target trusted data space, efficient circulation and sharing of data resources can be achieved. Data providers and data users can exchange data in a secure and trusted environment, reducing security risks and trust costs during data circulation.

[0069] On the basis of the above implementation manner, in some modified implementation manners, when the user type is a data provider, the server can also obtain a data packet in the operation request, which also includes a first target data attribute, and then decrypt the first target data attribute based on the target quantum key. If the decrypted first target data attribute is inconsistent with the data attribute, the data attribute is updated to the first target data attribute.

[0070] In the embodiment of the present application, the first target data attribute may refer to the latest data attribute of the data in the target trusted data space produced by the latest negotiation between the data user and the data provider. At the same time, the first target data attribute is also processed by the target quantum key.

[0071] The server can dynamically update data attributes according to actual conditions. When the first target data attributes after decryption are inconsistent with the data attributes, the server can immediately use the new data attributes as the current data attributes. This dynamic adjustment mechanism realizes the automation of data attribute management, making data control more flexible and timely.

[0072] Moreover, the target-based access control policy can dynamically decide whether to allow access to specific resources based on the role, attributes, and environmental conditions of the client's corresponding user. By evaluating the attribute set in the operation request, more fine-grained access control can be achieved, improving the security and flexibility of the target trusted data space.

[0073] In addition, centralized management and dynamic adjustment of access rights can reduce the workload of administrators and improve the maintainability of the trusted data space of the management and control targets. Since access control is based on attributes and policies, it can more easily adapt to changes and developments in management and control.

[0074] Step 103: When the user type of the current user is a data user, the server sends the second target data obtained from the target trusted data space to the client based on the data attribute, and generates an operation log.

[0075] In one implementation of an embodiment of the present application, the server can, when the user type is a data user, obtain second target data from the target trusted data space based on current data attributes, where the second target data is used to characterize usage data of a business application corresponding to the client, and then send the second target data to the client.

[0076] Based on the above implementation, in some modified implementations, the server can use quantum encryption technology to generate a target quantum key, and then encrypt the second target data based on the target quantum key, and send the encrypted second target data to the client.

[0077] Similarly, through strict access control policies, unauthorized users can be effectively prevented from accessing data in the target trusted data space or performing unauthorized operations, which helps to protect data security and reduce potential security risks. Moreover, the server can control access to decrypted data based on current access permissions, so that only users with corresponding permissions can access and use the data, thereby ensuring the compliance and security of data use.

[0078] Based on the above implementation, in some modified implementations, the server may respond to the message returned by the client indicating that the second target data has been successfully received, and then obtain the second target data attributes of the second target data, and update the current data attributes based on the second target data attributes.

[0079] In the embodiment of the present application, the second target data attribute may refer to the attribute that the user needs to update the data attribute of the second target data after using the data. For example, if the data attribute before receiving the message of successful reception of the second target data returned by the client includes data content A, data format B, data usage times 5, data usage time 2024.01.01-2024.12.31, data usage location C, data usage scenario D, data business application E, client role F, and client's data operation authority query, then when the server receives the message of successful reception of the second target data returned by the client, the data attribute corresponding to the second target data can be adjusted according to the actual usage, for example, the data usage times are adjusted to 4, the data usage locations are C, D, and so on.

[0080] The server can reduce the workload of administrators and improve the maintainability of the trusted data space of the management and control targets by centralized management and dynamic adjustment of data attributes. Since access control is based on attributes and policies, it can more easily adapt to changes and developments in management and control.

[0081] Moreover, by receiving the second target data received successfully message returned by the client, the server can timely understand the status of data transmission, so as to quickly respond and process subsequent operations. This real-time feedback mechanism helps to improve the server's response speed to the target trusted data space management and control, and improve the user experience of data users.

[0082] Step 104: The server determines whether the operation log is empty. If not, execute step 105.

[0083] Step 105: The server uses a preset behavior analysis model to perform risk analysis on the operation log to obtain a risk analysis result.

[0084] Step 106: The server determines whether the risk analysis result shows that the operation behavior of the current user meets the preset risk condition. If the risk analysis result shows that the operation behavior of the current user meets the preset risk condition, step 107 is executed.

[0085] Step 107: The server performs adjustment operations on the data attributes.

[0086] In an embodiment of the present application, the preset risk condition may refer to a risk threshold. The server may then use a preset behavior analysis model to analyze the operation log to obtain a risk prediction value for the operation log, and then compare the risk prediction value with the preset risk threshold. If the risk threshold exceeds the preset risk threshold, it is determined that the client's operation has a greater security risk, that is, it is determined that the client meets the preset risk condition, and adjustments are made to the client's access rights.

[0087] The preset risk conditions may also refer to operations that pose security risks to the data in the target trusted data space performed by the client, which may include operations such as deleting a preset amount of data at one time, modifying a preset amount of data in batches, etc. The server can then use a preset behavior analysis model to analyze the operation log. If one or more of the above operations exist in the operation log, it is determined that the client meets the preset risk conditions, and adjustments are made to the client's data attributes to reduce data risks.

[0088] It should be noted that the adjustment to the data attributes of the client may specifically be the adjustment of the role of the client. For example, before the adjustment, the role of the client is a system administrator, who can access all data in the target trusted data space. After the adjustment, the role of the client becomes an ordinary employee, who can only access part of the data in the target trusted data space. The adjustment to the access rights of the client may also be the change of the data operation rights of the client. For example, before the adjustment, the client can add, modify, delete and query data A. After the adjustment, the client can only query data A.

[0089] By real-time monitoring and analyzing user behavior, potential security threats can be discovered in a timely manner, such as abnormal access patterns, unauthorized data operations, etc. Once risky behavior is detected, the server can immediately adjust the data attributes of the business system in the client, which can significantly prevent further data security vulnerabilities or data leakage, greatly improving the security of data in the trusted data space; moreover, through the automated permission adjustment mechanism, the need for manual intervention can be reduced, management costs can be reduced, and the timeliness and accuracy of permission allocation can be improved.

[0090] Based on the above implementation, in some modified implementations, the server can store the operation log in the blockchain network, and then check whether the operation log complies with the preset contract service and generate a detection report. The contract service is used to characterize the business logic of the operation behavior.

[0091] In the embodiments of the present application, the contract service refers to the contract terms implemented based on blockchain technology, defined by programming language and stored on the blockchain, that is, the smart contract service, which can automatically perform various tasks, such as checking whether the operation log conforms to the business logic of the business application corresponding to the client. Smart contract service is a highly automated contract execution mechanism that uses blockchain technology to achieve automatic execution, thereby improving the security and efficiency of transactions.

[0092] By using smart contract services to check operation logs, it is possible to promptly discover whether the business logic of the client's corresponding business application is normal, which can effectively improve the audit efficiency of the server.

[0093] Based on the above implementation, in some modified implementations, if the operation log does not comply with the preset contract service, a warning message is generated, which is used to characterize the access abnormality of the client and is sent to the client.

[0094] By utilizing the computing resources on the server side, we can quickly process and analyze operation log data and identify potential security threats, so that the server can respond promptly when security threats are issued, reducing client losses. In addition, automated analysis can reduce the need for manual intervention, improve overall work efficiency, reduce operating costs, and improve overall data security.

[0095] On the basis of the above implementation manner, in some modified implementation manners, the server may also respond to the received test access request at preset time intervals, and when the test user type is a data provider, based on preset test data attributes, store the preset first test data provided to the test business system in the target trusted data space, and generate a test operation log; when the test user type is a data user, based on preset test data attributes, obtain the second test data required for the test business system from the target trusted data space and send it to the client, and generate a test operation log; check whether the test operation log complies with the business logic of the test business system, and generate a test detection report; if the test detection report is inconsistent with the preset detection report, a security warning is issued, and the security warning is used to characterize the access security level of the target trusted data space.

[0096] In the embodiment of the present application, the preset time interval may refer to the time interval set by the technicians in this field according to actual needs, or it may be the time interval obtained by the technicians in this field adjusting the set time interval according to actual needs, and the embodiment of the present application does not make any specific limitation.

[0097] At preset time intervals, using preset test data attributes and test user types, data management test operations are performed on the target trusted data space to check whether the operation logs generated by the data management test operations comply with the preset contract services, and a test inspection report is generated. If the test inspection report is inconsistent with the preset inspection report, a security warning is issued to ensure that the security warning function of the server remains effective, so that the security of data in the target trusted data space can be monitored and protected at all times.

[0098] The access control method of the embodiment of the present application is applied to the server.

[0099] In response to an operation request for a target trusted data space sent by a client, data attributes of a business system in the client are obtained, and the user type of a current user of the business system is determined, wherein the user type includes a data provider or a data user. When the user type of the current user is a data provider, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated. When the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated. This can improve the security of data in the target trusted data space, prevent unauthorized access and port scanning attacks, and reduce potential security risks during data management in multiple target trusted data spaces.

[0100] When the operation log is not empty, the preset behavior analysis model is used to perform risk analysis on the operation log to determine whether the current user's operation behavior meets the preset risk conditions. If the risk analysis result shows that the current user's operation behavior meets the preset risk conditions, the data attributes are adjusted to reduce data risks. By analyzing these operation logs, abnormal behaviors or potential security threats in the process of accessing the target trusted data space can be discovered in a timely manner, so that corresponding protective measures can be taken to improve the security of data in the target trusted data space. In addition, as the client's needs and behavior patterns change, the dynamic permission adjustment mechanism based on the risk analysis results can flexibly adjust the data attribute settings according to changes in real-time data and user behavior, thereby improving the management and control flexibility of the target trusted data space. Moreover, by limiting the client's data attribute permissions, the risk of data leakage or damage caused by misoperation can be reduced. At the same time, the dynamic permission adjustment mechanism based on the operation log can also predict and prevent potential misoperations based on the user's historical operation records and behavior patterns, further improving the security of data in the target trusted data space.

[0101] Figure 3 A business flow chart of an access control method shown in some embodiments of the present application, such as Figure 3As shown, the client sends an operation request for the target trusted data space to the server. The server responds to the operation request for the target trusted data space sent by the client, obtains the user identity information of the current user corresponding to the client, and then the server performs multi-factor or single sign-on identity authentication on the user identity information. If the authentication is successful, it is considered that the current user has access rights to the target trusted data space, and the server continues to obtain the data attributes of the business system in the client. At the same time, the server determines the user type of the current user of the business system in the client. The user type includes a data provider or a data user. Then, based on the target quantum key, data attributes and user type, the server performs data management operations on the target trusted data space, specifically including: the server generates a target quantum key using quantum key technology. When the user type of the current user is a data provider, The first target data is decrypted based on the target quantum key, and then, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated; when the user type of the current user is a data user, the second target data is encrypted based on the target quantum key, and then, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated; and when the operation log is not empty, the server uses a preset behavior analysis model to perform a risk analysis on the operation log to determine whether the current user's operation behavior meets the preset risk conditions. If the risk analysis result is that the current user's operation behavior meets the preset risk conditions, an adjustment operation is performed on the data attributes to reduce the data risk, and the server stores the operation behavior log to its blockchain network and performs an intelligent audit.

[0102] By utilizing the target quantum key, the data transmission is absolutely secure and forward-looking during the data management operations on the target trusted data space. In addition, the preset behavioral analysis model is used to conduct risk analysis on the operation logs. Based on the risk analysis results, the data attributes are adjusted to reduce data risks, effectively improve the degree of automation of security management and control of the target trusted data space, achieve elastic resource management, and reduce hardware costs and operation and maintenance costs. In addition, by strengthening the log analysis and exception response mechanism, the speed and accuracy of handling security incidents are improved.

[0103] See also Figure 4 The embodiment of the present application further provides an access control device, which is applied to a server and is used to execute the access control method described in the above embodiment, and the device includes:

[0104] The first acquisition module 10 is used to respond to the operation request for the target trusted data space sent by the client, acquire the current data attributes of the data in the business system in the client, and determine the user type of the current user of the business system, wherein the user type includes a data provider or a data user;

[0105] The storage module 20 is used for storing the first target data obtained from the client to the target trusted data space based on the data attribute and generating an operation log when the user type is a data provider;

[0106] A second acquisition module 30 is used for sending the second target data acquired from the target trusted data space to the client based on the data attribute and generating an operation log when the user type is a data user;

[0107] An analysis and judgment module 40 is used to perform risk analysis on the operation log using a preset behavior analysis model to determine whether the operation behavior of the current user meets a preset risk condition when the operation log is not empty;

[0108] The adjustment module 50 is configured to perform an adjustment operation on the data attribute if the risk analysis result shows that the operation behavior of the current user meets a preset risk condition.

[0109] The access control device provided in the embodiment of the present application and the access control method provided in the above embodiment are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0110] See also Figure 5 The embodiment of the present application also provides another access control device, which is applied to the server. The device is used to execute the access control method described in the above embodiment. The device includes:

[0111] The operation request receiving module 100 is used to receive an operation request for a target trusted data space sent by a client.

[0112] The identity authentication module 200 is used to obtain the user identity information of the current user of the business system according to the operation request, and then determine whether the current user has the access authority to the target trusted data space according to the user identity information.

[0113] The quantum encryption communication module 300 is used for data communication between the server and the client based on quantum encryption technology.

[0114] The dynamic data attribute management module 400 is used to dynamically adjust data attributes based on the operation log generated by the data management operation, wherein the data management operation includes: when the user type of the current user is a data provider, based on the data attributes, the first target data obtained from the client is stored in the target trusted data space, and an operation log is generated; when the user type of the current user is a data user, based on the data attributes, the second target data obtained from the target trusted data space is sent to the client, and an operation log is generated.

[0115] The intelligent audit and log module 500 is used to store the operation log in the blockchain network, check whether the operation log complies with the preset contract service, and generate a detection report. The contract service is used to characterize the business logic of the operation behavior.

[0116] The alarm and response module 600 is used to respond to receiving a preset test access request at every preset time interval; when the test user type is a data provider, based on the preset test data attributes, the preset first test data provided to the test business system is stored in the target trusted data space, and a test operation log is generated; when the test user type is a data user, based on the preset test data attributes, the second test data required for the test business system is obtained from the target trusted data space and sent to the client, and a test operation log is generated; the test operation log is checked to see if it complies with the business logic of the test business system, and a test detection report is generated; if the test detection report is inconsistent with the preset detection report, a security warning is issued.

[0117] The identity authentication module 200 further includes a multi-factor identity authentication module 201 and a single sign-on identity authentication module 202 .

[0118] The multi-factor authentication module 201 is used to obtain an authentication method for user identity information, which authentication method may include one or more authentications of fingerprint, voiceprint, encrypted password, iris, facial features, vein, human eye, geographic location and palm print, and then based on the authentication method, obtain the authentication information corresponding to the authentication method, the authentication information can be used to represent the username and password of the requesting user, and then determine whether the user's username and password are consistent with the preset username and password. If the username and password are consistent with the preset username and password, the authentication is successful.

[0119] The single sign-on identity authentication module 202 is used to authenticate the user's identity information through single sign-on.

[0120] The quantum encryption communication module 300 includes a target quantum key generation module 301 , a data encryption and decryption module 302 , and a data management module 303 .

[0121] The target quantum key generation module 301 is used to generate a target quantum key using quantum encryption technology.

[0122] The data encryption and decryption module 302 is used to obtain the data packet in the access request when the user type is a data provider, decrypt the first target data in the data packet based on the target quantum key, the first target data is used to represent the usage data of the business application corresponding to the client, and store the decrypted first target data in the target trusted data space based on the data attribute; when the user type is a data user, obtain the second target data from the target trusted data space based on the data attribute, the second target data is used to represent the usage data of the business application corresponding to the client, encrypt the second target data based on the target quantum key, and send the encrypted second target data to the client.

[0123] The data management module 303 is used to perform data management operations on the target trusted data space based on the target quantum key, the current data attributes and the user type.

[0124] The dynamic data attribute management module 400 includes a current data attribute acquisition module 401 , an operation log analysis module 402 and a data attribute dynamic adjustment module 403 .

[0125] The current data attribute acquisition module 401 is used to acquire the current data attributes of the business system in the client.

[0126] The operation log analysis module 402 is used to perform risk analysis on the operation log using a preset behavior analysis model.

[0127] The data attribute dynamic adjustment module 403 is used to determine whether the risk analysis result shows that the operation behavior of the current user meets the preset risk condition. If the risk analysis result shows that the operation behavior of the current user meets the preset risk condition, the data attribute is adjusted to reduce the data risk.

[0128] The intelligent audit and log module 500 includes a blockchain log recording module 501 and a smart contract audit module 502.

[0129] The blockchain log recording module 501 is used to store the operation log in the blockchain network.

[0130] The smart contract audit module 502 is used to check whether the operation log complies with the preset contract service and generate a detection report. The contract service is used to characterize the business logic of the operation behavior.

[0131] The alarm and response module 600 includes an abnormal behavior simulation detection module 601 and a security warning automatic response module 602 .

[0132] The abnormal behavior simulation detection module 601 is used to respond to receiving a preset test access request;

[0133] In the case where the test user type is a data provider, based on the preset test data attributes, the first test data preset to be provided to the test business system is stored in the target trusted data space, and a test operation log is generated; in the case where the test user type is a data user, based on the preset test data attributes, the second test data required for the test business system is obtained from the target trusted data space and sent to the client, and a test operation log is generated.

[0134] The security warning automatic response module 602 is used to check whether the operation log complies with the preset contract service and generate a test report; if the test report is inconsistent with the preset test report, a security warning is issued, and the security warning is used to characterize the access security level of the target trusted data space.

[0135] The access control device provided in the embodiment of the present application and the access control method provided in the above embodiment are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0136] The present application also provides an electronic device corresponding to the access control method provided in the above embodiment. Figure 6 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 6 As shown, the electronic device 70 may include: a processor 700, a memory 701, a bus 702 and a communication interface 703, and the processor 700, the communication interface 703 and the memory 701 are connected via the bus 702; the memory 701 stores a computer program that can be run on the processor 700, and when the processor 700 runs the computer program, it executes the access control method provided in any of the aforementioned embodiments of the present application.

[0137] The memory 701 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one physical port 703 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0138] The bus 702 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. Among them, the memory 301 is used to store programs, and the processor 300 executes the program after receiving the execution instruction. The access control method disclosed in any implementation of the embodiment of the present application may be applied to the processor 700, or implemented by the processor 700.

[0139] The processor 700 may be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 700 or an instruction in the form of software. The above processor 700 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 701, and the processor 700 reads the information in the memory 701 and completes the steps of the above method in combination with its hardware.

[0140] The electronic device provided in the embodiment of the present application and the access control method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0141] An embodiment of the present application also provides a computer-readable storage medium corresponding to the access control method provided in the aforementioned embodiment, on which a computer program (i.e., a program product) is stored. When the computer program is executed by a processor, it will execute the access control method provided in any of the aforementioned embodiments.

[0142] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0143] An embodiment of the present application also provides a computer program product corresponding to the access control method provided in the aforementioned embodiment, including a computer program, which is executed by a processor to implement the access control method provided in the aforementioned embodiments.

[0144] The computer-readable storage medium and computer program product provided in the above-mentioned embodiments of the present application are based on the same inventive concept as the access control method provided in the embodiments of the present application, and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0145] It should be noted that:

[0146] The algorithm and display provided herein are not inherently related to any particular computer, virtual device or other equipment. Various general purpose devices can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of device. In addition, the application is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to implement the content of the application described herein, and the description of the specific language above is to disclose the best mode of implementation of the application.

[0147] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0148] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0149] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0150] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0151] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the creation device of the virtual machine according to the embodiment of the present application. The application can also be implemented as a device or device program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0152] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0153] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An access control method, characterized in that: Applied to the server, including: In response to an operation request for a target trusted data space sent by a client, obtaining data attributes of a business system in the client, and determining a user type of a current user of the business system, wherein the user type includes a data provider or a data user; In the case where the user type of the current user is a data provider, based on the data attribute, storing the first target data obtained from the client into the target trusted data space, and generating an operation log; In the case where the user type of the current user is a data user, based on the data attribute, sending the second target data obtained from the target trusted data space to the client, and generating an operation log; When the operation log is not empty, using a preset behavior analysis model, a risk analysis is performed on the operation log to determine whether the operation behavior of the current user meets a preset risk condition; If the risk analysis result is that the operation behavior of the current user meets the preset risk condition, an adjustment operation is performed on the data attribute.

2. The access control method according to claim 1, characterized in that: The method further comprises: Generate a target quantum key; Before storing the first target data acquired from the client into the target trusted data space, decrypting the first target data based on the target quantum key; Before sending the second target data obtained from the target trusted data space to the client, the second target data is encrypted based on the target quantum key.

3. The access control method according to claim 1, characterized in that: Before acquiring the data attribute of the business system in the client and determining the user type of the current user of the business system, the method further includes: Determine the user identity information of the current user of the business system according to the operation request; Determining, based on the user identity information, whether the current user has access rights to the target trusted data space; If the judgment result is yes, the steps of obtaining the data attribute of the business system in the client and determining the user type of the current user of the business system are performed.

4. The access control method according to claim 2, characterized in that: In the case where the user type is a data provider, the method further includes: Obtaining a first target data attribute in the operation request; decrypting the first target data attribute based on the target quantum key; If the decrypted first target data attribute is inconsistent with the data attribute, the data attribute is updated to the first target data attribute.

5. The access control method according to claim 1, characterized in that: Also includes: In response to a message returned by the client indicating that the second target data is successfully received, acquiring a second target data attribute of the second target data; Based on the second target data attribute, the data attribute is updated.

6. The access control method according to any one of claims 1 to 5, characterized in that: The data attributes include any one or more of the following: data content, data format, number of data usage, data usage time, data usage location, data usage scenario, business application to which the data belongs, role to which the client belongs, and the client's operating authority over the data.

7. The access control method according to claim 1, characterized in that: Also includes: The operation log is stored in the blockchain network.

8. The access control method according to claim 7, characterized in that: Also includes: Check whether the operation log complies with the business logic of the business system; If the operation log does not conform to the business logic of the business system, a warning message is generated to prompt the client that the access is abnormal; The warning information is sent to the client.

9. An access control device, characterized in that: Applied to the server, including: A first acquisition module, configured to, in response to an access request sent by a client to access a target trusted data space, acquire current data attributes of data in a business system in the client, and determine a user type of a current user of the business system, wherein the user type includes a data provider or a data user; A storage module, configured to store the first target data acquired from the client to the target trusted data space based on the data attribute, and generate an operation log when the user type is a data provider; A second acquisition module is used to send the second target data acquired from the target trusted data space to the client based on the data attribute when the user type is a data user, and generate an operation log; An analysis and judgment module, configured to, when the operation log is not empty, perform risk analysis on the operation log using a preset behavior analysis model to determine whether the operation behavior of the current user meets a preset risk condition; The adjustment module is used to perform an adjustment operation on the data attribute if the risk analysis result shows that the operation behavior of the current user meets the preset risk condition.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

12. A computer program product, comprising a computer program, characterized in that The computer program is executed by a processor to implement the method according to any one of claims 1 to 7.

Images