Data protection method and system for computer data

Abstract

The invention relates to the field of data analysis and processing, in particular to a data protection method and system for computer data, and the method comprises the steps: obtaining the user behavior data of a login user, and evaluating the safety coefficient of the user behavior according to the user behavior data and standard behavior data; an authority control mode corresponding to the range in which the safety coefficient falls is determined as a target authority control mode, different safety coefficient ranges correspond to different authority control modes, and the authority control modes include that the authority level is not adjusted or the authority level is reduced; and managing and controlling the authority of the login user by using the target authority management and control mode. Therefore, the safety coefficient is evaluated according to the current user behavior, and the user permission is reduced to different degrees when the evaluated safety coefficient is relatively low, so that the protection on the system data can be enhanced when the abnormal behavior of the user is identified, and the safety of the system is further improved.

Description

Technical Field

[0001] The present invention relates to the field of data analysis and processing, and in particular to a data protection method and system for computer data. Background Art

[0002] There are many types of computer data, for example, it can be data in the field of pharmaceutical research and development. Data protection in the field of pharmaceutical research and development is facing increasing complexity, especially in terms of data security. Data protection in the pharmaceutical research and development process is crucial because it not only involves protecting intellectual property rights, trade secrets and patient privacy, but is also directly related to the safety, effectiveness and compliance of drugs. Ensuring data security can prevent unauthorized access and data leakage, thereby avoiding potential legal risks, economic losses and brand reputation damage.

[0003] Currently, the industry widely adopts role-based access control systems (RBAC) to strengthen data management in the drug R&D process and ensure that only authorized personnel can access sensitive data. This access control system strictly controls user access by defining different roles and corresponding access rights.

[0004] However, traditional role-based access control systems are often designed to be static, meaning that once roles and corresponding access rights are defined and assigned, they usually remain unchanged in the system. This static nature may cause data leaks, internal threats, or other security incidents. Therefore, although the RBAC system provides a clear access control framework in the early stages, its static nature still has a serious impact on the security of data protection. Summary of the invention

[0005] In order to solve the above technical problems, the object of the present invention is to provide a data protection method and system for computer data, comprising: Obtaining user behavior data of the logged-in user, and evaluating the safety factor of the user behavior based on the user behavior data and standard behavior data; Determine the permission control mode corresponding to the range within which the safety factor falls as the target permission control mode, wherein different safety factor ranges correspond to different permission control modes, and the permission control mode includes not adjusting the permission level or reducing the permission level; Use the target permission management method to manage the permissions of the logged-in user.

[0006] Optionally, after evaluating the safety factor of the user behavior according to the user behavior data and the standard behavior data, the data protection method for computer data further includes: If the safety factor is lower than a preset value, a safety authentication is performed on the logged-in user; The safety factor is corrected according to the safety authentication process data, wherein the safety authentication process data includes the authentication duration and / or the number of authentication failures.

[0007] Optionally, lowering the permission level includes at least one of the following: lowering the permission level by several levels, lowering the permission level to a basic level, and prohibiting all permissions.

[0008] Optionally, the user behavior data includes login behavior data and / or access behavior data.

[0009] Optionally, the user behavior data includes login behavior data, and the evaluating the safety factor of the user behavior based on the user behavior data and standard behavior data includes: The safety factor of the user behavior is calculated based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location.

[0010] Optionally, calculating the safety factor of the user behavior according to the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location, includes: The safety factor A of user behavior is calculated according to the following formula: in, The user's login time. is the number of standard login times, for of the standard login times Login time, is the number of standard login positions, This login location and of login locations The distance between the login locations, The time interval between this login time and the last alarm time; () indicates normalization processing, () indicates the minimum value operation. () represents the natural logarithm function.

[0011] Optionally, the user behavior data also includes access behavior data, and after calculating the safety factor of the user behavior, the following is further included: The safety factor is modified according to the access behavior data.

[0012] Optionally, the access behavior includes system data behavior within the access permission and / or system data behavior outside the access permission, and the step of correcting the security factor according to the access behavior data includes: For system data within the access permission range, the safety factor is modified according to the difference between the user's access frequency to the system data and the standard access frequency to the system data; and / or For system data outside the access rights, the safety factor is modified according to the number of times the user attempts to access the system data and the number of verification errors.

[0013] The present invention also provides a data protection system for computer data, the system comprising: An evaluation module, used to obtain user behavior data of a logged-in user, and evaluate the safety factor of the user behavior based on the user behavior data and standard behavior data; A determination module, used to determine the permission control mode corresponding to the range within which the safety factor falls as a target permission control mode, wherein different safety factor ranges correspond to different permission control modes, and the permission control mode includes not adjusting the permission level or reducing the permission level; The control module is used to control the permissions of the logged-in user using the target permission control method.

[0014] The present invention also provides a medium storing at least one program executable by a computer, wherein when the at least one program is executed by a computer, the computer executes the steps in the above-mentioned data protection method for computer data.

[0015] The present invention has the following beneficial effects: the safety factor is evaluated according to the current user behavior, and the user's originally fixed permissions are dynamically controlled to varying degrees according to the safety factor, and the user permissions are reduced to varying degrees when the evaluated safety factor is low, so that the protection of system data can be strengthened when the user's abnormal behavior is identified, thereby improving the security of the system. For example, when the system is attacked, the data information stored in the system can be protected as much as possible, thereby improving the risk response capability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 One of the flow charts of the data protection method for computer data provided by the embodiment of the present invention; Figure 2 A second flowchart of a method for protecting computer data provided by an embodiment of the present invention; Figure 3 A schematic diagram of modules of a data protection system for computer data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of a data protection method for computer data proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0019] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0020] The data protection method for computer data provided by the present invention performs permission control for a role-based access control system. The method can be for permission control of an existing role-based access control system, or it can be for first building a role-based access control system, and then further performing permission control on the built role-based access control system. For a role-based access control system, it defines a plurality of different roles, classifies the data in the access control system according to confidentiality requirements, and assigns corresponding data access rights to each role, ensuring that each role can only access the system data necessary to complete the work. Specifically, the data in the access control system is classified and the permission level for accessing each data category is defined, and the corresponding permission level is assigned to each role according to the work needs of each role. The data access rights corresponding to different roles may be the same or different, and each role may correspond to a plurality of different users. For example, for the pharmaceutical research and development industry, the plurality of roles may include laboratory researchers, data analysts, clinical trial coordinators, and safety managers, and each role may include multiple personnel, such as a laboratory may include multiple researchers, and the multiple researchers are multiple users corresponding to the role of "laboratory researcher". The role-based access control system also monitors and records the user's behavior in the access control system, such as login behavior, access behavior, modification behavior, etc. In this embodiment, the role-based access control system provides multiple permissions at different levels and allocates permissions of corresponding levels to users.

[0021] It should be noted that the above-mentioned pharmaceutical research and development industry is only used as an example and cannot be used as a limitation. The data protection method for computer data provided by the present invention can be applied not only to the data protection scenario of pharmaceutical research and development process data, but also to any other scenario where data protection is required.

[0022] A specific scheme of a data protection method for computer data provided by the present invention is described in detail below with reference to the accompanying drawings.

[0023] See also Figure 1 , which shows one of the flow charts of a data protection method for computer data (hereinafter referred to as the method) provided by an embodiment of the present invention, the method comprising the following steps: Step 101: Obtain user behavior data of a logged-in user, and evaluate the safety factor of the user behavior based on the user behavior data and standard behavior data.

[0024] In this step, the method obtains the user behavior data of the logged-in user, and evaluates the safety factor of the user behavior based on the user behavior data and the standard behavior data. The user behavior may include login behavior and / or access behavior, and accordingly, the user behavior data may include login behavior data and / or access behavior data.

[0025] The standard behavior data is data that is acquired and recorded in advance. The method can collect various behavior data of users, process various behavior data, and record them as standard behavior data. The processing of behavior data includes classifying and screening behavior data. For login behavior, the login behavior data may include login time and login location. For login time, the time can be divided into multiple time periods with a preset time span (for example, one hour), and the occurrence rate of login time in its corresponding time period is recorded. When the occurrence rate of a certain login time is greater than a first preset ratio (for example, 20%), the login time is recorded as one of the standard login times. For the login location, an optimal one can be determined according to the contour method. value, with this The value is used as the number of clusters, and the K-means clustering algorithm is used to process the positions, and the center point corresponding to the cluster whose ratio of the number of position points in the cluster to the total number of position points is greater than a second preset ratio (for example, greater than 20%) is recorded as one of the standard login positions, and the first preset ratio and the second preset ratio can be the same or different. For access behavior, the average access frequency of each type of system data can be used as the standard access frequency of this type of system data.

[0026] The processing of the behavior data also includes cleaning the behavior data before classification and screening, processing missing values ​​or abnormal values ​​in the behavior data, etc. It should be noted that the above-mentioned collection of various user behavior data must be collected in a safe mode operated by the user himself, so that the collected behavior data can better represent the user's usage habits.

[0027] In some embodiments, the method can also dynamically update the standard behavior data, for example, updating the standard behavior data according to the behavior data corresponding to the user behavior with a higher safety factor. Multiple users can share the standard behavior data, or record the corresponding standard behavior data for each user. It is understandable that, considering that different users have different usage habits and may have different usage requirements, in a preferred embodiment of the present invention, the corresponding standard behavior data can be recorded for each user separately, so that the safety factor of the user behavior can be more accurately evaluated.

[0028] The user behavior data may only include login behavior data, and the login behavior data includes login time and login location. The method may calculate the safety factor of the user behavior based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location. The user behavior data may also only include access behavior data. Accordingly, the method calculates the safety factor of the user behavior based on the user's access frequency to the system data and the standard access frequency to the system data. In some embodiments, the user behavior data may include both login behavior data and access behavior data. In this case, the method may first calculate the safety factor of the user behavior based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location, and then further correct the safety factor based on the difference between the user's access frequency to the system data and the standard access frequency to the system data.

[0029] Step 102: Determine the permission control method corresponding to the range within which the security factor falls as the target permission control method, wherein different security factor ranges correspond to different permission control methods, and the permission control methods include not adjusting the permission level or lowering the permission level.

[0030] In this step, the method searches for the permission control method corresponding to the range in which the security factor falls from a pre-stored mapping table of security factor ranges and permission control methods according to the security factor, and determines that the permission control method corresponding to the range in which the security factor falls is the target permission control method. The mapping table records the mapping relationship between multiple security factor ranges and multiple permission control methods, and different security factor ranges correspond to different permission control methods. The multiple permission control methods include not adjusting the permission level and reducing the permission level. It can be understood that reducing the permission level can include multiple reduction methods, such as reducing the permission level by several levels, reducing the permission level to the basic level, prohibiting all permissions, etc.

[0031] It should be noted that, in the embodiment of the present invention, the target authority control method determined according to the range in which the security factor falls can be to directly use the initially calculated security factor or to use the revised security factor. Accordingly, for the case where only the security factor is calculated but no further revision is made to the security factor, the method directly uses the initially calculated security factor; for the case where the security factor is revised, the method uses the revised security factor to determine the target authority control method, and for the case where multiple revisions are made, the method uses the final revised security factor to determine the target authority control method. That is to say, in the case where the security factor is revised, the method gives priority to using the final revised security factor, and in the case where the security factor is not revised, the method uses the calculated security factor. Table 1 below shows a mapping relationship table in an embodiment of the present invention, where S represents the security factor finally used, and the method can find the corresponding authority control method from Table 1 below as the target authority control method according to the range in which the security factor falls.

[0032] surface Security factor and permission control method mapping table Step 103: Use the target permission control method to control the permissions of the logged-in user.

[0033] In this step, the method uses the determined target permission control method to control the permissions of the logged-in user. When it is detected that the user's behavior is risky, the user's permissions will be reduced accordingly to prevent data leakage or further system damage. Through this dynamic permission control, it is possible to balance data protection and business needs, ensuring that the security of system data is prioritized in any case.

[0034] In some embodiments of the present invention, after executing step 103, the method continues to execute step 101, that is, the method continues to monitor user behavior and adjusts user permissions according to the security of user behavior. For example, the method can continue to run during user login to monitor the security of user behavior during login.

[0035] In this embodiment, the method obtains the user behavior data of the logged-in user, and evaluates the safety factor of the user behavior based on the user behavior data and the standard behavior data; determines that the permission control method corresponding to the range within which the safety factor falls is the target permission control method, wherein different safety factor ranges correspond to different permission control methods, and the permission control methods include not adjusting the permission level or reducing the permission level; and uses the target permission control method to control the permissions of the logged-in user. In this way, the safety factor is evaluated according to the current user behavior, and the user's originally fixed permissions are dynamically controlled to varying degrees according to the safety factor. When the evaluated safety factor is low, the user's permissions are reduced to varying degrees, which can strengthen the protection of system data when the user's abnormal behavior is identified, thereby improving the security of the system. For example, when the system is attacked, the data information stored in the system can be protected as much as possible, thereby improving the risk response capability of the system.

[0036] Optionally, lowering the permission level includes at least one of the following: lowering the permission level by several levels, lowering the permission level to a basic level, and prohibiting all permissions.

[0037] Optionally, the user behavior data includes login behavior data and / or access behavior data.

[0038] Optionally, the user behavior data includes login behavior data, and evaluating the safety factor of user behavior based on the user behavior data and standard behavior data includes: calculating the safety factor of user behavior based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location.

[0039] After the user logs in, the method will need to evaluate the safety factor of the current user behavior based on the user login behavior data. Considering that the user may have many daily office locations and office hours, the method can evaluate the safety factor based on the difference between the login time and the closest standard login time, and the difference between the login location and the closest standard login location. The larger the minimum difference between the login time and the standard login time, and / or the larger the value of the closest distance between the login location and the standard login location, the lower the security of the user's login behavior.

[0040] Optionally, calculating the safety factor of the user behavior according to the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location, includes: Calculate the safety factor of user behavior according to the following formula : in, The user's login time. is the number of standard login times, for of the standard login times Login time, is the number of standard login positions, This login location and of login locations The distance between the login locations, The time interval between this login time and the last alarm time; () indicates normalization processing, () indicates the minimum value operation. () represents the natural logarithm function.

[0041] Formula Description: Indicates the absolute value of the difference between this login time and the closest standard login time. Indicates the distance between the current login location and the closest standard login location.

[0042] In this embodiment, when the security factor is so low that all permissions need to be prohibited (for example, less than 0.5), the method will issue an alarm to remind relevant personnel to be vigilant. For example, the security administrator can conduct manual review based on the audit log and real-time alarms to ensure that it meets security requirements and does not affect the normal operation of the business process. Considering that user accounts are managed individually by users, the alarms of other users may not necessarily affect the security factor of this user. The most recent alarm time can be the last alarm time of the user. In some cases, the most recent alarm time can also be the last alarm time of all users, such as when the entire access control system is attacked from the outside, resulting in a situation where all users may have security risks.

[0043] In some cases, considering that R&D personnel usually log in in the laboratory, if they encounter a special emergency, they may need to temporarily log in from a distant place, so the safety factor should be higher at this time. However, due to the large difference between the login location and the standard login location, the safety factor calculated according to the above formula will inevitably not be high. Or the time when the intruder logs in happens to be close to the standard login time. In these cases, the safety factor calculated by the above formula cannot accurately represent the safety level of user behavior. For this reason, the safety factor needs to be corrected based on the actual situation.

[0044] Optionally, the user behavior data also includes access behavior data, and after calculating the safety factor of the user behavior, the step further includes: correcting the safety factor according to the access behavior data.

[0045] In this embodiment, after calculating the security factor based on the user login behavior data, the security factor is further modified based on the access behavior data. The greater the difference between the user's access frequency to various system data and the standard access frequency of such system data, the lower the security of the user.

[0046] Optionally, the access behavior includes system data behavior within the access permission and / or system data behavior outside the access permission, and the modifying of the security factor based on the access behavior data includes: for system data within the access permission, modifying the security factor based on the difference between the user's access frequency to the system data and the standard access frequency to the system data; and / or for system data outside the access permission, modifying the security factor based on the number of attempts by the user to access the system data and the number of verification errors.

[0047] In actual use, in some special cases, some roles may need to access system data that exceeds their own access rights. For this type of system data, a corresponding access password can be set for special access by roles that do not have access rights. The access password can be dynamically updated and kept by the security administrator. This can not only solve the inconvenience of roles being unable to access system data that is beyond their own rights but is necessary for work, but also ensure the security of system data. In this embodiment, the access behavior includes system data behavior within the access rights and / or system data behavior outside the access rights.

[0048] For the system data within the permission, the method can modify the safety factor according to the difference between the user's access frequency to the system data and the standard access frequency to the system data. Class Data ( is an integer greater than 0), where The access frequency recorded by the behavioral standard of class data is ( is greater than 0 and less than or equal to ), the user logs in to visit The frequency of class data is , then the corrected user login security It can be expressed as: in, Indicates that the user logs in to visit The access frequency of class data is The absolute value of the difference in the standard access frequency of the class data, It represents the sum of the absolute value of the difference between the access frequency of each type of data accessed by the user during this login and its standard access frequency. The larger the value, the lower the security of the user's access behavior. To prevent zero constants, prevent the denominator from being zero.

[0049] For unauthorized system data, the method can modify the security factor based on the number of times the user attempts to access the system data and the number of verification errors. Specifically, for unauthorized system data that requires an additional access password to access, the intruder will try to decipher the access password. During this process, there may be multiple access password input errors. The more times the access password is entered incorrectly, the greater the possibility of being invaded, and the lower the relative security. Assume that the number of times the user attempts to access unauthorized system data during this login is , the number of incorrect access password inputs is , then the corrected user login security It can be expressed as: In the above formula, , are integers greater than or equal to 0, As a whole, it represents the situation where users attempt to access external system data and try to decipher access passwords. The higher the value, the lower the security of the user's behavior.

[0050] In the embodiment of the present invention, the method can modify the security factor based on the access behavior of the system data within the authority, or can modify the security factor based on the access behavior of the system data outside the authority, or can modify the security factor based on the access behavior of the system data within the authority and the access behavior of the system data outside the authority at the same time. When modifying the security factor based on the above two methods, the modification order can be unlimited, and the modified value after the previous modification is used as the basis for the next modification, that is, the modified value obtained by the previous modification is used as the basis for the next modification. Will be revised later Substitute into the formula for further correction.

[0051] See also Figure 2 , which shows a second flow chart of a method for protecting computer data provided by an embodiment of the present invention, the method comprising the following steps: Step 201: Obtain user behavior data of the logged-in user, and evaluate the safety factor of the user behavior based on the user behavior data and standard behavior data.

[0052] This step 201 is the same as step 101 in the previous embodiment and will not be described again here.

[0053] Step 202: If the security factor is lower than a preset value, perform security authentication on the logged-in user.

[0054] In order to prevent misjudgment and affect the normal work of employees, a security authentication process can also be set in the access control system. When the security factor of user behavior is low, for example, it is so low that the permissions need to be adjusted, the security authentication process is triggered, and the user needs to complete the built-in multi-factor security authentication according to the prompts. During the security authentication, the factors that cause security abnormalities can be prompted. In this step, the preset value is the value that triggers the reduction of the permission level, such as 0.9.

[0055] Step 203: Correct the safety factor according to the safety authentication process data, wherein the safety authentication process data includes the authentication duration and / or the number of authentication failures.

[0056] When the user completes the multi-factor security authentication, the method will obtain the security authentication process data, which includes the authentication time and / or the number of authentication failures. The shorter the time it takes for the user to complete the security authentication, and the fewer incorrect items are entered during the complete security authentication process, the higher the security of the user's behavior. Assume that after the user logs in this time, the user security authentication process is triggered midway, and the authentication time it takes for the user to complete the security authentication is , the number of authentication failures during user security authentication is , then the user's security after correction It can be expressed as: It should be noted that in the above formula Indicates the safety factor closest to the first one. For example, if the calculated safety factor is not corrected, then represents the safety factor obtained by the initial calculation. If the calculated safety factor is corrected, then Indicates the safety factor after the most recent revision.

[0057] Step 204: Determine the permission control method corresponding to the range within which the security factor falls as the target permission control method, wherein different security factor ranges correspond to different permission control methods, and the permission control methods include not adjusting the permission level or lowering the permission level.

[0058] Step 205: Use the target permission control method to control the permissions of the logged-in user.

[0059] Steps 204 and 205 are the same as steps 102 and 103 in the previous embodiment, and will not be described again here.

[0060] In this embodiment, the method obtains the user behavior data of the logged-in user, and evaluates the safety factor of the user behavior based on the user behavior data and the standard behavior data; if the safety factor is lower than a preset value, security authentication is performed on the logged-in user; The security factor is modified according to the security authentication process data, wherein the security authentication process data includes the authentication time and / or the number of authentication failures; the permission control method corresponding to the range within which the security factor falls is determined as the target permission control method, wherein different security factor ranges correspond to different permission control methods, and the permission control methods include not adjusting the permission level or reducing the permission level; the target permission control method is used to control the permissions of the logged-in user. In this way, the method further starts security authentication when the security factor is low, and further modifies the security factor according to the security authentication process data, which can effectively prevent misjudgment from affecting the normal work of employees while ensuring data security.

[0061] The present invention also provides a data protection system for computer data. Figure 3 , the data protection system 300 for computer data comprises: Evaluation module 301, used to obtain user behavior data of the logged-in user, and evaluate the safety factor of the user behavior based on the user behavior data and standard behavior data; A determination module 302 is used to determine that the permission control mode corresponding to the range within which the safety factor falls is a target permission control mode, wherein different safety factor ranges correspond to different permission control modes, and the permission control mode includes not adjusting the permission level or reducing the permission level; The control module 303 is used to control the permissions of the logged-in user using the target permission control method.

[0062] In this embodiment, the data protection system for computer data evaluates the safety factor according to the current user behavior, and dynamically controls the user's originally fixed permissions to varying degrees according to the safety factor, and reduces the user's permissions to varying degrees when the evaluated safety factor is low, so that the protection of system data can be strengthened when the user's abnormal behavior is identified, thereby improving the security of the system. For example, when the system is attacked, the data information stored in the system can be protected as much as possible, thereby improving the risk response capability of the system.

[0063] Optionally, after evaluating the safety factor of the user behavior based on the user behavior data and the standard behavior data, the evaluation module 301 is also used to: if the safety factor is lower than a preset value, perform security authentication on the logged-in user; and correct the safety factor based on the security authentication process data, wherein the security authentication process data includes authentication duration and / or number of authentication failures.

[0064] Optionally, lowering the permission level includes at least one of the following: lowering the permission level by several levels, lowering the permission level to a basic level, and prohibiting all permissions.

[0065] Optionally, the user behavior data includes login behavior data and / or access behavior data.

[0066] Optionally, the user behavior data includes login behavior data, and the evaluation module 301 is specifically used to calculate the safety factor of the user behavior based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location.

[0067] Optionally, the evaluation module 301 calculates the safety factor of the user behavior according to the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location, including: The safety factor A of user behavior is calculated according to the following formula: in, The user's login time. is the number of standard login times, for of the standard login times Login time, is the number of standard login positions, This login location and of login locations The distance between the login locations, The time interval between this login time and the last alarm time; () indicates normalization processing, () indicates the minimum value operation. () represents the natural logarithm function.

[0068] Optionally, the user behavior data also includes access behavior data. After calculating the safety factor of the user behavior, the evaluation module 301 is further used to correct the safety factor according to the access behavior data.

[0069] Optionally, the access behavior includes system data behavior within the access permission and / or system data behavior outside the access permission, and the evaluation module 301 modifies the security factor based on the access behavior data, including: for system data within the access permission, modifying the security factor based on the difference between the user's access frequency to the system data and the standard access frequency to the system data; and / or for system data outside the access permission, modifying the security factor based on the number of times the user attempts to access the system data and the number of verification errors.

[0070] The embodiment of the present invention further provides a medium, wherein the medium stores at least one program executable by a computer, and when the at least one program is executed by the computer, the computer executes the steps in the data protection method for computer data in the above embodiment. The medium may be a computer-readable storage medium.

[0071] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0072] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A data protection method for computer data, characterized in that: The method comprises: Obtaining user behavior data of the logged-in user, and evaluating the safety factor of the user behavior based on the user behavior data and standard behavior data; Determine the permission control mode corresponding to the range within which the safety factor falls as the target permission control mode, wherein different safety factor ranges correspond to different permission control modes, and the permission control mode includes not adjusting the permission level or reducing the permission level; Use the target permission control method to control the permissions of the logged-in user; The user behavior data includes login behavior data and / or access behavior data; The user behavior data includes login behavior data, and the safety factor of user behavior evaluated based on the user behavior data and standard behavior data includes: The safety factor of the user behavior is calculated based on the time difference between the login time and the standard login time, and the location difference between the login location and the standard login location, including: The safety factor A of user behavior is calculated according to the following formula: in, The user's login time. is the number of standard login times, for of the standard login times Login time, is the number of standard login positions, This login location and of login locations The distance between the login locations, The time interval between this login time and the last alarm time; () indicates normalization processing, () indicates the minimum value operation. () represents the natural logarithm function.

2. The data protection method for computer data according to claim 1, characterized in that: After evaluating the safety factor of the user behavior according to the user behavior data and the standard behavior data, the method further includes: If the safety factor is lower than a preset value, a safety authentication is performed on the logged-in user; The safety factor is corrected according to the safety authentication process data, wherein the safety authentication process data includes the authentication duration and / or the number of authentication failures.

3. The data protection method for computer data according to claim 1, characterized in that: The lowering of the permission level includes at least one of the following: lowering the permission level by several levels, lowering the permission level to a basic level, and prohibiting all permissions.

4. The data protection method for computer data according to claim 1, characterized in that: The user behavior data also includes access behavior data. After calculating the safety factor of the user behavior, the following is also included: The safety factor is modified according to the access behavior data.

5. The data protection method for computer data according to claim 4, characterized in that: The access behavior includes system data behavior within the access permission and / or system data behavior outside the access permission, and the step of modifying the security factor according to the access behavior data includes: For system data within the access permission range, the safety factor is modified according to the difference between the user's access frequency to the system data and the standard access frequency to the system data; and / or For system data outside the access rights, the safety factor is modified according to the number of times the user attempts to access the system data and the number of verification errors.

6. A data protection system for computer data, the system being used to execute the method according to claim 1, characterized in that: The system comprises: An evaluation module, used to obtain user behavior data of a logged-in user, and evaluate the safety factor of the user behavior based on the user behavior data and standard behavior data; A determination module, used to determine the permission control mode corresponding to the range within which the safety factor falls as a target permission control mode, wherein different safety factor ranges correspond to different permission control modes, and the permission control mode includes not adjusting the permission level or reducing the permission level; The control module is used to control the permissions of the logged-in user using the target permission control method.

Images