Access control system and method based on data security

Abstract

The invention provides an access control system and method based on data security. The system comprises a user login unit, a permission allocation unit, an access request unit, a data access unit and an access control unit, the user login unit responds to login operation of a user and obtains a user identifier for identity verification; after the identity verification is passed, the user identifier is sent to the permission distribution unit; the permission distribution unit obtains a user permission matrix and a plurality of workflows participated by the user according to the user identifier, and sends the user permission matrix and the workflows to the data access unit through the access request unit; the access request unit sends an access request to the access control unit; the data access unit obtains accessible data of the user in different workflows according to the user permission matrix and the plurality of workflows; the access control unit monitors the access request to judge whether an access fusing mechanism is triggered or not; and if so, stopping accessing the accessible data. According to the method, fine-grained access control can be realized, and the flexibility is improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an access control system and method based on data security. Background Art

[0002] In the digital age, as the amount of business data continues to increase, data security and confidentiality become increasingly important. Therefore, it is necessary to effectively control data access to reduce the risk of data leakage.

[0003] At present, mandatory access control is usually adopted. Mandatory access control is mainly based on security level. For complex business environments, it is difficult to meet fine-grained access control requirements and lacks flexibility. Summary of the invention

[0004] The embodiments of the present application provide an access control system and method based on data security, so as to achieve the effect of realizing fine-grained access control requirements and improving flexibility.

[0005] In a first aspect, an embodiment of the present application provides an access control system based on data security, comprising: a user login unit, a permission allocation unit, an access request unit, a data access unit and an access control unit;

[0006] The user login unit is used to obtain the user identification in response to the user's login operation on the target system, and authenticate the user according to the user identification; after the identity authentication is passed, the user identification is sent to the authority allocation unit;

[0007] The authority allocation unit obtains the user authority matrix and the multiple workflows in which the user participates according to the user identifier; and sends the user authority matrix and the multiple workflows to the access request unit;

[0008] The access request unit is used to send an access request to the access control unit, and send the user authority matrix and multiple workflows to the data access unit;

[0009] The data access unit obtains the accessible data of the user in different workflows in the target system according to the user authority matrix and multiple workflows;

[0010] The access control unit monitors the access request to determine whether the access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

[0011] In a possible implementation, the target system includes multiple workflows; accordingly, the data access unit obtains the user's accessible data in different workflows in the target system based on the user authority matrix and the multiple workflows, including: the data access unit obtains the user's identity in any workflow; the data access unit obtains the user's accessible data in any workflow based on the identity in any workflow and the user authority matrix, so as to obtain the user's accessible data in different workflows in the target system.

[0012] In one possible implementation, the access control unit includes an access recording module and an access auditing module; accordingly, the access control unit monitors the access request to determine whether to trigger the access fuse mechanism, including: the access recording module monitors the access request, records the access request frequency and network traffic, and sends the access request frequency and network traffic to the access auditing module; the access auditing module determines whether the access request frequency exceeds the access threshold, and whether the network traffic exceeds the network traffic threshold; if the access auditing module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered.

[0013] In a possible implementation, after the access fuse mechanism is triggered, the method further includes: when the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, triggering the access recovery mechanism.

[0014] In a possible implementation, the access control system based on data security also includes: a data storage unit; accordingly, it also includes: the data storage unit classifies the data in the target system according to the historical access times to obtain high-frequency access data, normal access data and low-frequency access data; the data storage unit stores the high-frequency access data, normal access data and low-frequency access data in the high-frequency area, normal area and low-frequency area of ​​the database respectively.

[0015] In a possible implementation, the access control system based on data security also includes: a data encryption unit; accordingly, after the data storage unit stores the high-frequency access data, normal access data and low-frequency access data in the high-frequency area, normal area and low-frequency area of ​​the database respectively, it also includes: the data encryption unit encrypts the high-frequency access data in the high-frequency area to obtain encrypted data in the high-frequency area; the data encryption unit encrypts the normal access data in the normal area to obtain encrypted data in the normal area; the data encryption unit encrypts the low-frequency access data in the low-frequency area to obtain encrypted data in the low-frequency area.

[0016] In a second aspect, an embodiment of the present application provides an access control method based on data security, including: obtaining a user identification in response to a user's login operation on a target system through a user login unit, and authenticating the user based on the user identification; sending the user identification to a permission allocation unit after the identity authentication is passed; obtaining a user permission matrix and multiple workflows in which the user participates based on the user identification through the permission allocation unit; and sending the user permission matrix and multiple workflows to an access request unit; using the access request unit to send an access request to an access control unit, and sending the user permission matrix and multiple workflows to a data access unit; obtaining accessible data of the user in different workflows in the target system based on the user permission matrix and multiple workflows through the data access unit; monitoring the access request through the access control unit to determine whether an access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

[0017] In a possible implementation, the target system includes multiple workflows; accordingly, the data access unit obtains the user's accessible data in different workflows in the target system based on the user authority matrix and the multiple workflows, including: obtaining the user's identity in any workflow through the data access unit; obtaining the user's accessible data in any workflow through the data access unit based on the identity in any workflow and the user authority matrix, so as to obtain the user's accessible data in different workflows in the target system.

[0018] In one possible implementation, the access control unit includes an access recording module and an access auditing module; accordingly, the access control unit monitors the access request to determine whether to trigger the access fuse mechanism, including: monitoring the access request through the access recording module, recording the access request frequency and network traffic, and sending the access request frequency and network traffic to the access auditing module; determining through the access auditing module whether the access request frequency exceeds the access threshold, and whether the network traffic exceeds the network traffic threshold; if the access auditing module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered; when the access auditing module determines that the access request frequency is lower than the access threshold, and the network traffic is lower than the network traffic threshold, the access recovery mechanism is triggered.

[0019] In a possible implementation, it also includes: obtaining a storage area of ​​accessible data in a database through a data access unit; if the storage area is encrypted data in a high-frequency area, limiting the number of accesses to the accessible data within a preset time; if the storage area is encrypted data in a normal area, not restricting access to the accessible data; if the storage area is encrypted data in a low-frequency area, determining whether the user identifier exists in a preset whitelist, and if not, not allowing access to the accessible data.

[0020] The data security-based access control system and method provided in the embodiment of the present application obtains the user authority matrix of different users and the multiple workflows in which the users participate according to the user identification; according to the multiple workflows in which the users participate and the user authority matrix in the target system, the accessible data of any user in different workflows can be obtained, and the accessible data of different users can be determined when new business needs arise, so as to realize fine-grained access control requirements and increase the flexibility of access control. In addition, by monitoring the access request to determine whether the access fuse mechanism is triggered; if the access fuse mechanism is triggered, the access to the accessible data is stopped, which can prevent data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 A schematic diagram of the structure of a data security-based access control system provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of a data security-based access control method provided in an embodiment of the present application.

[0024] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0026] In the digital age, as the amount of business data continues to increase, data security and confidentiality are becoming increasingly important. Therefore, it is necessary to effectively control access to data to reduce the risk of data leakage. At present, mandatory access control is usually adopted. Mandatory access control is mainly based on security levels. For complex business environments, it is difficult to meet fine-grained access control requirements and lacks flexibility.

[0027] In order to solve the above technical problems, the embodiments of the present application propose the following technical concepts: Considering that it is difficult to meet the fine-grained access control requirements by adopting mandatory access control, the flexibility is insufficient. The inventor thought of obtaining the workflows in which the user participates, and dynamically adjusting the user's accessible data according to the user's identity in different workflows, so as to achieve fine-grained access control requirements and improve flexibility. According to the user identification, the user authority matrix of different users and the multiple workflows in which the user participates are obtained; according to the multiple workflows and user authority matrix in which the user participates in the target system, the accessible data of any user in different workflows can be obtained, and when new business needs arise, the accessible data can also be obtained in the new workflow, so as to achieve fine-grained access control requirements and improve flexibility.

[0028] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0029] Figure 1 A schematic diagram of the structure of a data security access control system provided in an embodiment of the present application, such as Figure 1 As shown, the system provided by the embodiment of the present application includes: a user login unit 101, a permission allocation unit 102, an access request unit 103, a data access unit 104 and an access control unit 105.

[0030] The user login unit is used to obtain the user identification in response to the user's login operation on the target system, and authenticate the user according to the user identification; after the identity authentication is passed, the user identification is sent to the authority allocation unit.

[0031] In this embodiment, the user identifier is unique, and different users have different user identifiers.

[0032] In this embodiment, the user's identity is authenticated, including the user ID and password.

[0033] Optionally, encryption technology is used to encrypt and store passwords entered by users to prevent password theft; an account lock mechanism can be set to lock the account after multiple incorrect password entries to prevent brute force cracking.

[0034] Optionally, identity authentication can also introduce biometric technologies, such as fingerprint and facial recognition, to improve the security and convenience of identity authentication.

[0035] The authority allocation unit obtains the user authority matrix and multiple workflows in which the user participates according to the user identifier; and sends the user authority matrix and the multiple workflows to the access request unit.

[0036] Among them, workflow refers to the process of organizing and coordinating a series of related activities, tasks and decisions according to certain rules and sequence in order to complete tasks in the business process.

[0037] The components of a workflow include: activities, sequences, conditions, participants, and data; activities: the basic unit in a workflow, representing specific tasks or operations, such as filling out forms, reviewing documents, sending emails, etc.; sequences: the order in which activities are executed, which determines the direction of the workflow; conditions: used to determine which activities should be executed in a specific situation. For example, when a certain data meets a certain condition, a specific task is executed; participants: people or systems participating in a workflow, who are responsible for executing various activities; data: information transmitted and processed in a workflow, such as documents, form data, approval opinions, etc.

[0038] The target system includes multiple workflows.

[0039] In this embodiment, different user identities are determined according to user identifiers, such as department manager, ordinary employee, data administrator, etc. At the same time, the scope of responsibility of each user is clarified, for example, employees in the sales department are responsible for entering and querying sales data, and employees in the finance department are responsible for processing financial data, etc. The authority status of different positions in different departments on different data resources and operations is listed in a table. For example, "yes" or "no" can be used to indicate whether the authority is possessed, so as to obtain a user authority matrix.

[0040] The access request unit is used to send an access request to the access control unit, and send the user authority matrix and multiple workflows to the data access unit.

[0041] The data access unit obtains the accessible data of the user in different workflows in the target system according to the user authority matrix and multiple workflows.

[0042] Specifically, the data access unit obtains the identity of the user in any workflow; the data access unit obtains the accessible data of the user in any workflow according to the identity and the user authority matrix in any workflow, so as to obtain the accessible data of the user in different workflows in the target system.

[0043] In this embodiment, the user's identity identifiers are different in different workflows.

[0044] The target system includes multiple workflows.

[0045] In this embodiment, permissions are automatically adjusted according to the user roles involved in the workflow to obtain accessible data. For example, in the approval process, the applicant fills in the data in the application stage, and the approver obtains the permission to view and approve the relevant data in the approval stage, while the permissions of other users, such as applicants and ordinary employees, are restricted. After the approval is completed, the permissions of the relevant data may be further adjusted according to the process results. When any workflow is started, the workflow system updates the user's permissions and accessible data in real time according to the current stage and user responsibilities, ensuring that the accessible data is dynamically adjusted according to the different responsibilities of the user in different workflows.

[0046] The access control unit monitors the access request to determine whether the access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

[0047] The access control unit includes an access recording module and an access auditing module.

[0048] Specifically, the access recording module monitors access requests, records the access request frequency and network traffic, and sends the access request frequency and network traffic to the access audit module; the access audit module determines whether the access request frequency exceeds the access threshold, and whether the network traffic exceeds the network traffic threshold; if the access audit module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered.

[0049] Among them, the access threshold and the network traffic threshold are pre-set.

[0050] In this embodiment, when the access audit module detects a sudden high-frequency access that exceeds the access threshold, or a high-volume network traffic access that exceeds the network traffic threshold, the access control module will activate the access fuse mechanism to control and supervise the user's access request. In severe cases, in order to prevent continuous data leakage, the system will be locked, that is, any access request will be completely prohibited. This is an extreme security measure designed to protect sensitive data from being illegally obtained.

[0051] In summary, according to the user ID, the user authority matrix of different users and the multiple workflows in which the users participate can be obtained; according to the multiple workflows in which the users participate and the user authority matrix in the target system, the accessible data of any user in different workflows can be obtained, and when new business needs arise, the accessible data of different users can be determined to achieve fine-grained access control needs, increasing the flexibility of access control. In addition, by monitoring access requests to determine whether the access fuse mechanism is triggered; if the access fuse mechanism is triggered, access to the accessible data is stopped, which can prevent data leakage.

[0052] On the basis of the above embodiment, after the access fuse mechanism is triggered, it also includes: when the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, the access recovery mechanism is triggered.

[0053] In this embodiment, if the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, that is, when the access request frequency and the network traffic return to the normal range, indicating that the target system is safe, the access recovery mechanism is triggered to ensure that the target system resumes normal operation as soon as possible under the premise of safety, thereby reducing the impact on the business.

[0054] In summary, after the access fuse mechanism is triggered, when the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, the access recovery mechanism is triggered to restore normal access to the target system in a timely manner.

[0055] On the basis of the above embodiment, in this embodiment, the access control system based on data security further includes a data storage unit, which is introduced in detail as follows:

[0056] The data storage unit classifies the data in the target system according to the historical access times to obtain high-frequency access data, normal access data and low-frequency access data.

[0057] Among them, high-frequency access data includes data that is frequently accessed. This data may be business-critical data or data that users frequently use; normal access data includes data with a medium access frequency. This data may be some regular business data or data that is not frequently used; low-frequency access data includes data that is rarely accessed.

[0058] In this embodiment, the classification standard is preset, and classification is performed according to the number of historical accesses to obtain high-frequency access data, normal access data, and low-frequency access data.

[0059] The data storage unit stores the high-frequency access data, the normal access data and the low-frequency access data in the high-frequency area, the normal area and the low-frequency area of ​​the database respectively.

[0060] In summary, different storage strategies can be adopted according to the characteristics of different access frequencies. On the one hand, it can meet the needs of large-scale data processing and storage and optimize the use of storage resources. On the other hand, by storing data in categories, different cache strategies and index strategies can be adopted according to different access frequencies to improve data access efficiency. In addition, data classification storage can make data management clearer and more convenient. Administrators can formulate different data backup strategies, data cleaning strategies, and data security strategies according to different access frequencies to improve the efficiency and quality of data management.

[0061] On the basis of the above embodiment, in this embodiment, the access control system based on data security further includes a data encryption unit, which is introduced in detail as follows:

[0062] The data encryption unit encrypts the high-frequency access data in the high-frequency area to obtain high-frequency area encrypted data.

[0063] The data encryption unit encrypts the normal access data of the normal area to obtain the normal area encrypted data.

[0064] The data encryption unit encrypts the low-frequency access data in the low-frequency area to obtain low-frequency area encrypted data.

[0065] In this embodiment, encryption is performed using an encryption algorithm.

[0066] In summary, encryption is a key means of protection. By encrypting data, plaintext data can be converted into ciphertext, making it difficult to understand and use even if the data is illegally obtained, thereby effectively protecting the confidentiality and integrity of the data.

[0067] Figure 2 A flowchart of a data security-based access control method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method includes:

[0068] S201: In response to a user's login operation on a target system, a user login unit obtains a user ID and performs identity authentication on the user according to the user ID; after the identity authentication is passed, the user ID is sent to a permission allocation unit.

[0069] S202: The authority allocation unit obtains a user authority matrix and multiple workflows in which the user participates according to the user identifier; and sends the user authority matrix and the multiple workflows to the access request unit.

[0070] S203: The access request unit is used to send an access request to the access control unit, and send the user authority matrix and multiple workflows to the data access unit.

[0071] S204: Obtaining accessible data of the user in different workflows in the target system through the data access unit according to the user authority matrix and multiple workflows.

[0072] The target system includes multiple workflows.

[0073] Specifically, the user's identity in any workflow is obtained through the data access unit; the user's accessible data in any workflow is obtained through the data access unit based on the identity in any workflow and the user authority matrix, so as to obtain the user's accessible data in different workflows in the target system.

[0074] S205: The access control unit monitors the access request to determine whether the access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

[0075] The access control unit includes an access recording module and an access auditing module.

[0076] Specifically, step S205 includes S2051-S2054:

[0077] S2051: monitoring access requests through the access record module, recording the access request frequency and network traffic, and sending the access request frequency and network traffic to the access audit module;

[0078] S2052: Determine through the access audit module whether the access request frequency exceeds the access threshold and whether the network traffic exceeds the network traffic threshold.

[0079] S2053: If the access audit module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered.

[0080] S2054: When the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, the access recovery mechanism is triggered.

[0081] In summary, according to the user ID, the user authority matrix of different users and the multiple workflows in which the users participate are obtained; according to the multiple workflows in which the users participate and the user authority matrix in the target system, the accessible data of any user in different workflows is obtained, and when new business needs arise, the accessible data of different users can be determined to achieve fine-grained access control requirements, thereby increasing the flexibility of access control. In addition, by monitoring access requests to determine whether the access fuse mechanism is triggered; if the access fuse mechanism is triggered, access to accessible data is stopped, which can prevent data leakage. After the access fuse mechanism is triggered, when the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, the access recovery mechanism is triggered to restore normal access to the target system in a timely manner.

[0082] Based on the above embodiment, in this embodiment, the process of access control for data in different areas is introduced, which is detailed as follows:

[0083] The storage area of ​​accessible data in the database is obtained through the data access unit.

[0084] If the storage area is high frequency area encrypted data, the number of accesses to the accessible data is limited within a preset time.

[0085] In this embodiment, by setting a limit on the number of accesses to high-frequency area data within a preset time, malicious users are prevented from obtaining data through frequent access.

[0086] Optionally, the preset time is pre-set.

[0087] If the storage area is a normal area for encrypted data, there is no access restriction on the accessible data.

[0088] If the storage area is encrypted data in the low-frequency area, it is determined whether the user identification exists in a preset whitelist, and if not, access to the accessible data is not allowed.

[0089] In this embodiment, the preset whitelist is pre-set, and the whitelist can be set according to specific personnel to ensure that only authorized personnel can access the encrypted data in the low-frequency area.

[0090] Optionally, since the accessible data returned to the user is encrypted, it is decrypted before being returned.

[0091] In summary, different access controls are used for data in the three frequency zones. On the one hand, fine-grained access control is achieved; on the other hand, access security of data in different frequency zones is improved.

[0092] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0094] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An access control system based on data security, characterized in that: include: User login unit, authority allocation unit, access request unit, data access unit and access control unit; The user login unit is used to obtain a user identification in response to a user's login operation on the target system, and authenticate the user according to the user identification; after the authentication is passed, the user identification is sent to the authority allocation unit; The authority allocation unit obtains a user authority matrix and a plurality of workflows in which the user participates according to the user identifier; and sends the user authority matrix and the plurality of workflows to the access request unit; The access request unit is used to send an access request to the access control unit, and send the user authority matrix and the multiple workflows to the data access unit; The data access unit acquires the accessible data of the user in different workflows in the target system according to the user authority matrix and the multiple workflows; The access control unit monitors the access request to determine whether an access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

2. The data security-based access control system according to claim 1, characterized in that: The target system includes a plurality of workflows; Accordingly, the data access unit obtains the accessible data of the user in different workflows in the target system according to the user authority matrix and the multiple workflows, including: The data access unit obtains the identity of the user in any workflow; The data access unit obtains the accessible data of the user in any workflow according to the identity identifier in any workflow and the user authority matrix, so as to obtain the accessible data of the user in different workflows in the target system.

3. The data security-based access control system according to claim 1, characterized in that: The access control unit includes an access recording module and an access auditing module; Accordingly, the access control unit monitors the access request to determine whether to trigger the access fuse mechanism, including: The access recording module monitors the access requests, records the access request frequency and the network traffic, and sends the access request frequency and the network traffic to the access audit module; The access audit module determines whether the access request frequency exceeds an access threshold, and whether the network traffic exceeds a network traffic threshold; If the access audit module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered.

4. The data security-based access control system according to claim 3, characterized in that: After the access fuse mechanism is triggered, the following steps are also included: When the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, an access recovery mechanism is triggered.

5. The data security-based access control system according to claim 1, characterized in that: The data security-based access control system further includes: a data storage unit; Accordingly, it also includes: The data storage unit classifies the data in the target system according to the number of historical accesses to obtain high-frequency access data, normal access data and low-frequency access data; The data storage unit stores the high-frequency access data, the normal access data, and the low-frequency access data in a high-frequency area, a normal area, and a low-frequency area of ​​a database, respectively.

6. The data security-based access control system according to claim 5, characterized in that: The data security-based access control system further includes: a data encryption unit; Correspondingly, after the data storage unit stores the high-frequency access data, the normal access data and the low-frequency access data in the high-frequency area, the normal area and the low-frequency area of ​​the database respectively, it further includes: The data encryption unit encrypts the high-frequency access data in the high-frequency area to obtain high-frequency area encrypted data; The data encryption unit encrypts the normal access data of the normal area to obtain the normal area encrypted data; The data encryption unit encrypts the low-frequency access data in the low-frequency area to obtain low-frequency area encrypted data.

7. A data security-based access control method, characterized in that: Applied to the data security-based access control system according to any one of claims 1 to 6; the method comprises: The user login unit obtains a user ID in response to a user's login operation on the target system, and authenticates the user based on the user ID; after the authentication is passed, the user ID is sent to the authority allocation unit; Acquiring a user authority matrix and a plurality of workflows in which the user participates according to the user identifier through the authority allocation unit; and sending the user authority matrix and the plurality of workflows to the access request unit; The access request unit is used to send an access request to the access control unit, and send the user authority matrix and the multiple workflows to the data access unit; Acquiring, by the data access unit, the accessible data of the user in different workflows in the target system according to the user authority matrix and the multiple workflows; The access request is monitored by the access control unit to determine whether an access fuse mechanism is triggered; if the access control unit triggers the access fuse mechanism, access to the accessible data is stopped.

8. The method according to claim 7, characterized in that The target system includes a plurality of workflows; Accordingly, the acquiring, by the data access unit according to the user authority matrix and the multiple workflows, the accessible data of the user in different workflows in the target system includes: Obtaining the identity of the user in any workflow through the data access unit; The data access unit obtains the accessible data of the user in any workflow according to the identity identifier in any workflow and the user authority matrix, so as to obtain the accessible data of the user in different workflows in the target system.

9. The method according to claim 7, characterized in that: The access control unit includes an access recording module and an access auditing module; Accordingly, the access control unit monitors the access request to determine whether to trigger the access fuse mechanism, including: The access request is monitored by the access recording module, the access request frequency and the network traffic are recorded, and the access request frequency and the network traffic are sent to the access audit module; Determining, by the access audit module, whether the access request frequency exceeds an access threshold, and whether the network traffic exceeds a network traffic threshold; If the access audit module determines that the access request frequency exceeds the access threshold, and / or the network traffic exceeds the network traffic threshold, the access fuse mechanism is triggered; When the access audit module determines that the access request frequency is lower than the access threshold and the network traffic is lower than the network traffic threshold, an access recovery mechanism is triggered.

10. The method according to claim 7, characterized in that Also includes: Acquiring a storage area of ​​accessible data in a database through the data access unit; If the storage area is high-frequency encrypted data, the number of accesses to the accessible data is limited within a preset time; If the storage area is encrypted data in a normal area, no access restriction is imposed on the accessible data; If the storage area is low-frequency encrypted data, it is determined whether the user identifier exists in a preset whitelist, and if not, access to the accessible data is not allowed.

Images