Electronic seal safety management method for digital enterprise

Abstract

The invention relates to the technical field of data processing, and provides an electronic seal safety management method for a digital enterprise, which comprises the following steps: acquiring attributes and access conditions of all user electronic seals in a digital enterprise management platform; acquiring a plurality of groups of attributes of the electronic seal of each user; analyzing historical changes and overall access conditions of attributes in the same group of attributes to obtain an attribute replacement coefficient of each group of attributes; comparing the change of the access conditions of the two groups of attributes within a period of time before the current moment, and quantifying the current attribute access similarity of any two groups of attributes; constructing an attribute access graph structure; and analyzing the similarity of connection relationships between the sub-graphs of the advanced users and the nodes corresponding to each group of attributes of other users, obtaining the possibility that each advanced user is subjected to collusion attack at the current moment, and carrying out safety management on the electronic seal of each user. The invention aims to solve the problem that a plurality of low-level users attack related permissions of high-level users through electronic seal collusion.

Description

Technical Field

[0001] The invention relates to the technical field of data processing, and in particular to a method for safely managing electronic seals of a digital enterprise. Background Art

[0002] An electronic seal is an identity mark generated based on cryptographic technology and represented by an electronic data graphic. It is used to achieve the integrity, authenticity and non-repudiation of various electronic documents by effectively binding digital certificates, signature keys and physical seal images. In digital enterprise management, the authentication center grants users access to files by determining the attributes covered by their electronic seals. Due to differences in user authority levels, low-level users cannot access some of the authority files of high-level users. Electronic seals serve as identity marks for user access rights.

[0003] The electronic seal of a low-level user covers fewer attributes. On the contrary, the higher the authority level of a senior user, the more attributes his electronic seal covers due to his higher authority, and the more difficult it is to crack. However, since the attributes are shared by multiple users, multiple low-level users may collude to attack the authority files of senior users by collecting their attributes. Due to the operation method of the authentication center in digital enterprise management, it is impossible to completely avoid collusion attacks on authority access. Therefore, it is necessary to adjust the attributes covered by the electronic seal of the low-level user through attribute modification before the collusion attack to avoid the occurrence of collusion attacks on the authority files of senior users. Summary of the invention

[0004] The present invention provides a method for electronic seal security management of a digital enterprise to solve the existing problem that multiple low-level users collude to attack the relevant permissions of high-level users through electronic seals. The technical solution adopted is as follows: The present invention proposes a method for electronic seal security management of a digital enterprise, the method comprising the following steps: Obtain the attributes and access status of all users' electronic seals in the digital enterprise management platform; Obtain several groups of attributes of each user's electronic seal; analyze the historical changes of attributes in the same group of attributes and the overall access situation before the attribute changes, and compare the access situation of each user before the corresponding attribute changes, and obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal; Compare the changes in the access conditions of the two groups of attributes within a period of time before the current moment, and quantify the current attribute access similarity of any two groups of attributes; combine the attribute replacement coefficient of each group of attributes, and construct an attribute access graph structure for each group of attributes of all users' electronic seals, wherein each node in the attribute access graph structure corresponds to each group of attributes of each user's electronic seal; The similarity of the connection relationship between the subgraph of senior users in the attribute access graph structure and the nodes corresponding to each group of attributes of multiple users' electronic seals is analyzed, and the possibility of collusion attack for each senior user at the current moment is obtained in combination with the corresponding relationship between the nodes and the user's electronic seals, so as to perform security management of the electronic seals of each user.

[0005] Optionally, the specific method for obtaining the several groups of attributes of each user's electronic seal is as follows: For any number of attributes contained in the electronic seal of a user, the start time and end time of each attribute are obtained since the electronic seal is obtained, and the duration of each attribute contained in the electronic seal of the user is obtained accordingly; The end time of any attribute is concatenated with the attributes with the same start time among the attributes other than the attribute, and several attributes are concatenated into a group of attributes, and so on to obtain several groups of attributes of the user's electronic seal.

[0006] Optionally, the method of analyzing the historical changes of attributes in the same group of attributes and the overall access situation before the attribute changes, and comparing the access situation of each user before the corresponding attribute changes, to obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal includes the following specific methods: For User electronic seal In the group attributes property, get the The total access frequency of the corresponding permission from its start time to its end time, and record the The access frequency of each attribute corresponding to the permission from its start time to its end time on each day; Get the The ratio of the access frequency of the last day from the start time to the end time of the permission corresponding to the attribute to the total access frequency is obtained. The access frequency increment of each day from the start time to the end time of the corresponding permission of the attribute relative to the previous day is obtained. The average of the differences between the access frequency increment of the last day relative to the second last day and the access frequency increment of other days relative to the previous day from the start time to the end time of the corresponding permission of the attribute, and the product of the mean and the ratio is taken as the value of the first The abnormal change weight of each attribute; According to the duration of each attribute in the same group of attributes of the same user, and the access of the user to the corresponding authority of the attribute through the electronic seal, combined with the abnormal change weight, the attribute replacement coefficient of each group of attributes of each user's electronic seal is obtained.

[0007] Optionally, the attribute replacement coefficient of each group of attributes of each user's electronic seal is obtained based on the duration of each attribute in the same group of attributes of the same user, and the access of the user to the corresponding authority of the attribute through the electronic seal, combined with the abnormal change weight, including the specific method of: Get the A user uses an electronic seal to In the group attributes The attribute corresponds to the access frequency of the permission from its start time to the last day of the end time. User electronic seal Attribute replacement coefficient of group attributes The calculation method is: in, Indicates User electronic seal The coefficient of variation of the duration of each attribute in the group attribute, Indicates User electronic seal the number of attributes in the group attribute, Indicates User electronic seal In the group attributes The abnormal change weight of each attribute, Indicates the The access frequency of each attribute corresponding to the permission from its start time to the last day of the end time. Indicates The user uses an electronic seal to The visit frequency of the last day from its start time to the end time.

[0008] Optionally, the comparison of changes in access conditions of two groups of attributes within a period of time before the current moment to quantify the current attribute access similarity of any two groups of attributes includes the following specific methods: For the current moment, obtain the attributes of each group of attributes of each user's electronic seal at the current moment as the current attributes of each user. For any two groups of attributes of any two users' electronic seals, obtain the access frequency of the current attributes of any one of the two users from the start time to the end time when the user's electronic seal is changed to the current attribute, and arrange them in time sequence to form the access sequence of the user's current attribute. Obtain the access sequence of the current attribute of another user, and obtain the DTW distance between the two access sequences of the two current attributes of the two users through DTW matching; For the access sequences of the two current attributes of the two users, the last three elements of the two access sequences are respectively intercepted to form the access data segments of the two current attributes, and the cosine phase velocity and DTW distance between the access data segments of the two current attributes are obtained. The current attribute access similarity of the two sets of attributes of the electronic seals of the two users is calculated as follows: in, Indicates User electronic seal Group attributes and User electronic seal the current attribute access similarity of the group attributes, and Respectively represent User and The cosine phase velocity and DTW distance between the access data segments of the two current attributes of a user, Indicates User and The DTW distance between the access sequences of two current attributes of a user; For any two sets of attributes of the same user's electronic seal that correspond to each other at the current moment, the attributes are recorded as the current attributes of the two sets of attributes, and the start time of the current attributes of the user's electronic seal for the two sets of attributes is obtained, and the start time closest to the current moment to the current moment is used as the analysis period; The access frequency of the user's electronic seal to the current attributes of the two groups of attributes on each day during the analysis period is obtained, and the access frequency sequences of the current attributes of the two groups of attributes are respectively constructed in chronological order, and the cosine similarity between the two access frequency sequences is used as the current attribute access similarity of the two groups of attributes of the user's electronic seal.

[0009] Optionally, the specific method of constructing an attribute access graph structure for each set of attributes of all user electronic seals is as follows: The users whose electronic seals contain groups with a number less than the user classification parameter are regarded as low-level users, and the others are regarded as high-level users; For any senior user, each group of attributes of the senior user's electronic seal is regarded as a node, and each node corresponding to the senior user is fully connected to form a fully connected graph of the senior user, in which the node value is assigned as the attribute replacement coefficient of the corresponding group attribute, and the edge values ​​between nodes are all set to 1; For any low-level user, each group attribute of the low-level user's electronic seal is regarded as a node, and each node corresponding to the low-level user is fully connected to form a fully connected graph of the low-level user, in which the node value is assigned as the attribute replacement coefficient of the corresponding group attribute, and the edge value between nodes is set as the current attribute access similarity of different group attributes corresponding to the node; If the current attribute access similarity of different groups of attributes of different users is greater than the similarity threshold, the nodes corresponding to the two groups of attributes are connected, and the edge value is set to the corresponding current attribute access similarity; Similarly, the current attribute access similarity of each user's node is judged, and the corresponding nodes are connected and the corresponding edge values ​​are obtained; the graph structure composed of the fully connected graph of each user and the edges connecting the nodes in the fully connected graphs of different users is used as the attribute access graph structure.

[0010] Optionally, the analyzing the similarity of the connection relationship between the subgraph of the senior user in the attribute access graph structure and the nodes corresponding to each group of attributes of the electronic seals of multiple users, and combining the corresponding relationship between the nodes and the electronic seals of the users, to obtain the possibility of each senior user being attacked by collusion at the current moment, includes the following specific methods: For the fully connected graph of the advanced users, several similar subgraphs of the fully connected graph of each advanced user are obtained based on the connection relationship between the nodes of the users with lower authority; Analyze the difference between the node value and edge value between the similar subgraph and its corresponding fully connected graph, and obtain the graph access similarity between each similar subgraph and its corresponding fully connected graph; According to the nodes included in the similar subgraph and their corresponding users, as well as the graph access similarity between the similar subgraph and its corresponding fully connected graph, the possibility of each high-level user being attacked by collusion at the current moment is obtained.

[0011] Optionally, the fully connected graph of the advanced user is used to obtain several similar subgraphs of the fully connected graph of each advanced user based on the connection relationship between nodes of users with lower authority, including the specific method of: For any advanced user's fully connected graph, based on the current attributes of the corresponding group attributes of each node in the fully connected graph, several nodes with the same current attributes of the corresponding group attributes in the attribute access graph structure are obtained, and based on the connection relationship between the several nodes, several subgraphs with the same structure as the fully connected graph are obtained, which are recorded as several similar subgraphs of the fully connected graph.

[0012] Optionally, the fully connected graph of the advanced user is used to obtain several similar subgraphs of the fully connected graph of each advanced user based on the connection relationship between nodes of users with lower authority, including the specific method of: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of edges in the fully connected graph, Indicates the similar subgraph The edge value of the edge, Indicates the first The edge value of the edge; Indicates the similar subgraph One endpoint of the edge corresponds to the attribute replacement coefficient of the group attribute. Indicates the similar subgraph The other end point of the edge corresponds to the attribute replacement coefficient of the group attribute; Represents a minimum value function.

[0013] Optionally, the method of obtaining the possibility of collusion attack for each high-level user at the current moment based on the nodes included in the similar subgraph and their corresponding users, and the graph access similarity between the similar subgraph and its corresponding fully connected graph, includes the following specific methods: For any high-level user's fully connected graph and any similar subgraph thereof, the user corresponding to the node contained in the similar subgraph is recorded as the participating user of the similar subgraph; the access similarity coefficient between the similar subgraph and the fully connected graph is The calculation method is: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of nodes in the similar subgraph, represents the number of users participating in the similar subgraph, The total number of nodes included in the fully connected graph of all participating users of the similar subgraph.

[0014] The beneficial effects of the present invention are as follows: the present invention analyzes the access situation of each attribute under the same group of attributes of the user's electronic seal, and quantifies the possibility of each attribute being attacked and replaced based on the change of the access situation; at the same time, the attribute replacement coefficient of each group of attributes of the user's electronic seal is quantified by combining the access situation of the user through the electronic seal before the change of each attribute under the same group of attributes, reflecting the abnormal possibility of the user using the electronic seal to attack the corresponding authority of the attribute; respectively, the recent access situation of the corresponding attributes at the current moment is similarly analyzed for different groups of attributes of the electronic seals of different users and different groups of attributes of the electronic seals of the same user, and this is used as the basis for connection judgment between graph structure nodes and The edge value, and the node corresponds to each group of attributes. By constructing a graph structure, the subgraphs and connection relationships in it can reflect the overall access relationship between the attributes of each group of user's electronic seals at the current moment, providing a basis for the subsequent collusion attack analysis; by analyzing the connection relationship between the subgraph of the high-level user and other nodes of the attribute access graph structure, based on similar structures and the attribute replacement coefficients corresponding to the nodes and the current attribute access similarity between the nodes, it reflects the possibility of low-level users colluding to attack the high-level user's permissions, and then by judging the possibility of collusion attacks, the user's electronic seals are managed securely, thereby reducing the risk of abnormal access to the digital enterprise management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 A schematic flow chart of a method for securely managing electronic seals of a digital enterprise provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 , which shows a flow chart of a method for electronic seal security management of a digital enterprise provided by an embodiment of the present invention, the method comprising the following steps: Step S001: Acquire the attributes and access status of all users' electronic seals in the digital enterprise management platform.

[0019] The purpose of this embodiment is to provide early warning of possible collusion among multiple low-level users to attack high-level user permissions in a digital enterprise management platform, and to achieve security management by adjusting the attributes covered by electronic seals. This requires regularity and change analysis of the attributes of the electronic seals of each user in the digital enterprise management platform and their access conditions, and therefore requires the collection of corresponding data and access conditions.

[0020] Specifically, in any digital enterprise management platform, the attributes covered by all user electronic seals since the platform started running are obtained, including all attributes covered by the user's electronic seal from the start of the platform running to the current moment, and the time when the attribute changes; at the same time, each user's electronic seal is recorded for each visit to the platform, and the access frequency of the user's electronic seal in different time periods is its access status.

[0021] Step S002, obtaining several groups of attributes of each user's electronic seal; analyzing the historical changes of attributes in the same group and the overall access situation before the attribute changes, and comparing the access situation of each user before the corresponding attribute changes, to obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal.

[0022] Preferably, in one embodiment of the present invention, a specific method for obtaining several groups of attributes of each user's electronic seal is as follows: It should be noted that, since the attributes covered by the electronic seal are subject to change, even if the user's electronic seal only covers one attribute at each moment, the attributes obtained may include multiple attributes due to the change. In this case, it is necessary to analyze the multiple attributes as a group of attributes of the user's electronic seal, and obtain several groups of attributes of each user's electronic seal by extracting and continuously analyzing the start time and end time of the attributes.

[0023] Specifically, for several attributes contained in any user's electronic seal, the start time and end time of each attribute are obtained since the electronic seal is collected, and the duration of each attribute contained in the user's electronic seal is obtained; the end time of any attribute is spliced ​​with the attribute with the same start time in other attributes except the attribute, and then according to the same analysis of the end time and the start time, several attributes are spliced ​​into a group of attributes, and so on to obtain several groups of attributes of the user's electronic seal; wherein after the electronic seal is collected, the attributes covered by the electronic seal at the corresponding moment are all at the start time, then the number of groups included in the user's electronic seal is the number of attributes with the same start time as the time when the electronic seal is collected; at the same time, the same end time and start time corresponding to the end of one attribute in each group of attributes and the start of the next attribute are recorded as the time when the attributes in the corresponding group of attributes change.

[0024] It should be noted that during the historical changes in the attributes of user electronic seals, the attribute changes usually include two situations. One is that the authority under the corresponding attribute is attacked, and the corresponding attribute covered by the electronic seals of all users corresponding to the corresponding attribute needs to be modified; the other is that among the electronic seals of several users covering the corresponding attribute, there is a user who cancels the electronic seal, then the corresponding attribute needs to be modified to avoid the leakage of authority caused by the cancellation.

[0025] It should be further explained that, in the process of analyzing the attributes covered by the user's electronic seal, the electronic seal covers one or more attributes. Under one attribute, it is first necessary to analyze the access frequency before the attribute changes. The more frequent the access, the greater the possibility that the attribute authority is modified due to an attack. At the same time, the greater the access frequency of the user itself, the corresponding user may be an abnormal user who attacks the attribute authority. In the process of attribute change, the shorter the duration of each attribute in a group of attributes of the same user, the more frequent the changes in the group of attributes of the user's electronic seal. By quantifying the attribute replacement coefficient, the frequent changes in the corresponding group attributes of the user and the possibility of abnormal behavior under the corresponding group attributes are reflected.

[0026] Preferably, in one embodiment of the present invention, the historical changes of attributes in the same group of attributes and the overall access situation before the attribute changes are analyzed, and the access situation of each user before the corresponding attribute changes is compared to obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal, including the specific method of: First User electronic seal In the group attributes Take the first attribute as an example, and obtain the The total access frequency of the corresponding permission from its start time to its end time, where the start time and end time are both User electronic seal In the group attributes The start and end time of the attribute, not the The start time of the attribute itself (because the user may receive the electronic seal midway and obtain the first The total access frequency is the number of times all users with the corresponding authority access the electronic seal during the period; at the same time, the first The access frequency of each day from the start time to the end time of the corresponding permission, then the The abnormal change weight of each attribute The calculation method is: in, Indicates User electronic seal In the group attributes The total access frequency of the corresponding permission from its start time to its end time. Indicates the The duration of the attribute ( User electronic seal The corresponding duration under the group attribute, in days), Indicates the The access frequency of each attribute corresponding to the permission from its start time to the last day of the end time. Indicates the The attribute corresponds to the permission from its start time to the end time. Day relative to The visit frequency increment of the day is the difference between the visit frequency of the next day and the visit frequency of the previous day. Indicates the The access frequency increment of the last day relative to the second last day from the start time to the end time of the corresponding permission.

[0027] It should be noted that in this group of attributes The longer the duration of each attribute is, the greater the proportion of the access frequency of the last day of the corresponding permission to the total access frequency, and the greater the difference between the access frequency increment corresponding to the last day and the access frequency increment of other days, the greater the impact of the last day on the first attribute. The greater the possibility that the access to the corresponding permission of an attribute is abnormal, the more likely it is that the attribute replacement is caused by an attack. The greater the weight of abnormal changes in the attributes, the greater the weight of abnormal changes in the attributes. In particular, if the visit frequency increment corresponding to the last day is smaller than the visit frequency increments of other days, the above formula result will output a negative number, reflecting the first The smaller the weight of abnormal changes in an attribute.

[0028] Further, get the The user uses an electronic seal to The access frequency of the attribute corresponding to the permission from its start time to the last day of the end time, then User electronic seal Attribute replacement coefficient of group attributes The calculation method is: in, Indicates User electronic seal The coefficient of variation of the duration of each attribute in the group attribute (the ratio of the standard deviation to the mean), Indicates User electronic seal the number of attributes in the group attribute, Indicates User electronic seal In the group attributes The abnormal change weight of each attribute, Indicates the The access frequency of each attribute corresponding to the permission from its start time to the last day of the end time. Indicates The user uses an electronic seal to The visit frequency of the last day from its start time to the end time.

[0029] It is particularly noted that, for the attributes corresponding to each group of attributes at the current moment, the end time is calculated based on the current moment, and the other related parameters are obtained according to the above method.

[0030] It should be noted that the duration of each attribute in the same group of attributes is relatively short, and the differences between the durations lead to a large standard deviation, and thus a large coefficient of variation. In this case, the attributes in the same group of attributes are more likely to be abnormal attribute replacements, and the corresponding permissions of this group of attributes are more likely to be changed due to multiple attacks. At the same time, the greater the proportion of the user's access frequency to the corresponding attribute through the electronic seal on the last day to the overall access frequency of the corresponding attribute on the last day, the more likely the user is an attacker who attacks the corresponding attribute permissions through the electronic seal, and the larger the attribute replacement coefficient of the corresponding group of attributes, the more it can reflect the abnormal possibility of the user attacking the corresponding permissions of the attribute through the electronic seal.

[0031] At this point, by analyzing the access situation of each attribute under the same group of attributes of the user's electronic seal, the possibility of each attribute being attacked and replaced is quantified based on the changes in the access situation; at the same time, combined with the user's access situation before the change of each attribute under the same group of attributes through the electronic seal, the attribute replacement coefficient of each group of attributes of the user's electronic seal is quantified, reflecting the abnormal possibility of the user using the electronic seal to conduct an attribute corresponding permission attack.

[0032] Step S003, compare the changes in the access conditions of the two groups of attributes within a period of time before the current moment, quantify the current attribute access similarity of any two groups of attributes; combine the attribute replacement coefficient of each group of attributes, and construct an attribute access graph structure for each group of attributes of all users' electronic seals.

[0033] Preferably, in one embodiment of the present invention, the changes in the access conditions of two groups of attributes within a period of time before the current moment are compared to quantify the current attribute access similarity of any two groups of attributes, including the specific method of: It should be noted that in order to analyze the collusion of low-level users to attack high-level users, it is necessary to consider that multiple low-level users have gathered the corresponding attribute permissions of high-level users at the same time. Since the attributes covered by the electronic seal are unknown among different users, in the process of gathering the corresponding attribute permissions of high-level users, there will be more and more similar access behaviors among different users. It is necessary to conduct a similarity analysis of the access behaviors of different groups of attributes of different users at the current moment. As for different groups of attributes of the same user, since the same user accesses the corresponding attribute permissions through the electronic seal, the time range of the analysis remains consistent, and a similarity analysis of the access behaviors over a certain period of time in the recent period is conducted.

[0034] It should be further explained that in the process of similar behavior analysis of different groups of attributes, different groups of attributes with the same attributes at the current moment will not be analyzed. That is, in order to reduce the risk of discovery during a collusion attack, multiple users will not be involved in the same attribute. Therefore, the attributes of different groups of users belong to the same attribute at the current moment, and no similarity analysis is required.

[0035] Specifically, for the current moment, the attributes of each group of attributes of each user's electronic seal at the current moment are obtained as the current attributes of each user. For any two groups of attributes of any two users' electronic seals, where the current attributes of the two groups of attributes are different, the access frequency of the user's electronic seal to its current attributes every day from the start time to the end time when the user's electronic seal is changed to the current attribute is obtained, and the access sequence of the user's current attribute is formed in time sequence. Similarly, the access sequence of the current attribute of another user is obtained, and the DTW distance between the access sequences of the two current attributes of the two users is obtained through DTW matching; the analysis time is preset, and the analysis time in this embodiment is described using three days. For the access sequences of the two current attributes of the two users, the last three elements of the two access sequences are respectively intercepted to form the access data segments of the two current attributes, that is, the data segments formed by the access frequencies of the past three days at the current moment, and the cosine phase velocity and DTW distance between the access data segments of the two current attributes are obtained. Then, the calculation method of the current attribute access similarity of the two groups of attributes of the electronic seals of the two users is as follows: in, Indicates User electronic seal Group attributes and User electronic seal the current attribute access similarity of the group attributes, and Respectively represent User and The cosine phase velocity and DTW distance between the access data segments of the two current attributes of a user, Indicates User and The DTW distance between the access sequences of two current attributes of a user.

[0036] What needs to be explained is that, at the current moment, the greater the similarity between the recent access situations of different groups of attributes of electronic seals of different users, and the greater the change in similarity compared to the overall access situation, the more similar the access behaviors between the current attributes of the two groups of attributes become. The greater the similarity in the access of the current attributes, the more likely it is that users of the corresponding two groups of attributes are preparing to collude to attack high-level user permissions through electronic seals.

[0037] It should be further explained that for different groups of attributes of the same user's electronic seal, since not all attributes are necessarily needed in the process of permission access, similar behaviors between different groups of attributes also need to be quantified. The more similar the access behaviors between different groups of attributes are, the higher the convergence is, and the greater the possibility that the corresponding user will access multi-attribute permissions multiple times through the electronic seal, and the greater the possibility that multiple groups of attributes of the same user will subsequently participate in a collusion attack.

[0038] Specifically, for any two groups of attributes of the same user's electronic seal that correspond to each other at the current moment, the attributes are respectively recorded as the current attributes of the two groups of attributes, and the start time of the current attributes of the user's electronic seal for the two groups of attributes is obtained, and the start time closest to the current moment to the current moment is used as the analysis period; the access frequency of the user's electronic seal to the current attributes of the two groups of attributes on each day during the analysis period is obtained, and the access frequency sequences of the current attributes of the two groups of attributes are respectively constructed in time sequence, and the cosine similarity between the two access frequency sequences is used as the current attribute access similarity of the two groups of attributes of the user's electronic seal.

[0039] Furthermore, the current attribute access similarity of any two groups of attributes is obtained according to the above method, including the current attribute access similarity of different groups of attributes of electronic seals of different users and the current attribute access similarity of different groups of attributes of electronic seals of the same user, wherein the current attributes of different groups of attributes are not obtained if they are the same.

[0040] It should be noted that for the analysis of collusion attacks, each user's group attributes need to be used as a node, and the current attribute access similarity between different groups of attributes is used to determine the connection relationship between nodes. The nodes corresponding to different groups of attributes of the same user need to be fully connected, that is, the same user can selectively access the corresponding permissions of multiple attributes, rather than being unable to access multiple attributes at the same time; at the same time, for different groups of attributes of different users corresponding to nodes, the ones with the greater current attribute access similarity can be connected, that is, the connection relationship between the nodes of low-level users is used to perform subsequent similarity comparisons with the fully connected subgraphs of high-level users.

[0041] Preferably, in one embodiment of the present invention, in combination with the attribute replacement coefficient of each group of attributes, an attribute access graph structure is constructed for each group of attributes of all user electronic seals, including the specific method of: Preset user classification parameters. In this embodiment, the user classification parameters are described as 4. Users whose electronic seals contain groups less than the user classification parameters are regarded as low-level users, and others are regarded as high-level users. For any high-level user, each group of attributes of the high-level user's electronic seal is regarded as a node, and each node corresponding to the high-level user is fully connected to form a fully connected graph of the high-level user, in which the node values ​​are assigned as the attribute replacement coefficients of the corresponding group attributes, and the edge values ​​between the nodes are set to 1. For any low-level user, each group of attributes of the low-level user's electronic seal is regarded as a node, and each node corresponding to the low-level user is fully connected to form a fully connected graph of the low-level user, in which the node values ​​are assigned as the attribute replacement coefficients of the corresponding group attributes, and the edge values ​​between the nodes are set to the current attribute access similarity of different group attributes corresponding to the nodes.

[0042] Furthermore, for users whose electronic seals contain more than 1 groups, corresponding fully connected graphs are obtained, while for users whose electronic seals contain 1 groups, a group of their attributes is directly taken as a node; for different groups of attributes of different users, a similarity threshold is preset, and the similarity threshold in this embodiment is described as 0.6. If the current attribute access similarity of different groups of attributes of different users is greater than the similarity threshold, the nodes corresponding to the two groups of attributes are connected, and the edge value is set to the corresponding current attribute access similarity; and so on, the current attribute access similarity is judged for the nodes of each user, and the corresponding nodes are connected and the corresponding edge values ​​are obtained; the graph structure composed of the fully connected graph of each user and the edges connecting the nodes in the fully connected graphs of different users is used as the attribute access graph structure; then the fully connected graphs of each user are subgraphs of the attribute access graph structure.

[0043] It should be noted that since high-level users are less likely to participate in collusion attacks, and if they do, the simultaneous participation of multiple attributes in the attack will greatly increase the success rate of the attack, the edge values ​​in their fully connected graphs are set to 1; while for the fully connected graphs of low-level users, the current attribute access similarity between different groups of attributes is still used as the edge value.

[0044] So far, we have conducted a similarity analysis on the recent access to the corresponding attributes of different groups of electronic seals of different users and different groups of attributes of electronic seals of the same user at the current moment, and used this as the basis for connection judgment and edge value between nodes in the graph structure. The nodes correspond to each group of attributes. By constructing a graph structure, the subgraphs and connection relationships in it can reflect the overall access relationship between the attributes of each group of electronic seals of each user at the current moment, providing a basis for subsequent collusion attack analysis.

[0045] Step S004, analyzing the similarity of the connection relationship between the subgraph of the senior user in the attribute access graph structure and the nodes corresponding to each group of attributes of the electronic seals of multiple users, combining the corresponding relationship between the nodes and the user's electronic seals, obtaining the possibility of collusion attack for each senior user at the current moment, and using this to perform security management of the electronic seals of each user.

[0046] It should be noted that in the attribute access graph structure, for the fully connected graph formed internally by advanced users, it is necessary to screen subgraphs from the connection relationships between the nodes of low-level users and lower-level advanced users and perform similarity analysis with the fully connected graph of advanced users. On the basis of structural similarity, it is necessary to further compare the node values ​​and edge values, so as to perform similarity analysis of access situations on the basis of similar graph structures. The fewer different users a similar subgraph contains, the higher the success rate of a collusion attack will be, and the less user nodes are wasted, the more the stability of a collusion attack can be improved. It is necessary to analyze the nodes in the similar subgraphs and their corresponding users, so as to quantify the access similarity coefficient between the similar subgraphs and the fully connected graph of advanced users, and then obtain the possibility of advanced users being attacked by collusion based on the access similarity coefficient.

[0047] Preferably, in one embodiment of the present invention, the specific method included in this step is: For the fully connected graph of the advanced users, several similar subgraphs of the fully connected graph of each advanced user are obtained based on the connection relationship between the nodes of the users with lower authority; Analyze the difference between the node value and edge value between the similar subgraph and its corresponding fully connected graph, and obtain the graph access similarity between each similar subgraph and its corresponding fully connected graph; According to the nodes included in the similar subgraph and their corresponding users, as well as the graph access similarity between the similar subgraph and its corresponding fully connected graph, the possibility of collusion attack for each senior user at the current moment is obtained; Determine the possibility of the conspiracy attack, analyze the risk of abnormal access to the digital enterprise management platform, and perform security management on the electronic seals of each user.

[0048] As an example, for a fully connected graph of a high-level user, based on the connection relationship between nodes of users with lower authority, several similar subgraphs of the fully connected graph of each high-level user are obtained, including the specific method of: For any advanced user's fully connected graph, based on the current attributes of the group attributes corresponding to each node in the fully connected graph, obtain several nodes with the same current attributes of the corresponding group attributes in the attribute access graph structure, and based on the connection relationship between the several nodes, obtain several subgraphs with the same structure as the fully connected graph (the nodes have the same corresponding current attributes, and the connection relationship between the nodes is the same as the edges in the fully connected graph), which are recorded as several similar subgraphs of the fully connected graph; it is particularly noted that in the acquisition of the several nodes mentioned above, if the user corresponding to the node has the same authority level as the advanced user, that is, the number of groups contained in the electronic seal is the same, then the node does not participate in the acquisition.

[0049] As an example, the difference relationship between the node value and the edge value between the similar subgraph and its corresponding fully connected graph is analyzed to obtain the graph access similarity between each similar subgraph and its corresponding fully connected graph, including the following specific methods: For any advanced user's fully connected graph and any similar subgraph thereof, the calculation method of graph access similarity is: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of edges in the fully connected graph, Indicates the similar subgraph The edge value of the edge, Indicates the first The edge value of each edge, where the edge value in the fully connected graph of advanced users is 1; Indicates the similar subgraph The attribute replacement coefficient of the group attribute corresponding to one endpoint (node) of the edge, Indicates the similar subgraph The other end point of the edge corresponds to the attribute replacement coefficient of the group attribute; Represents a minimum value function.

[0050] It should be noted that based on the similarity of the structures of the fully connected graph and the similar subgraph, the corresponding node values ​​and edge values ​​need to be further analyzed. In the fully connected graph of advanced users, all edge values ​​are 1, and the closer the edge value is to 1 in the similar subgraph, the greater the similarity of the current attribute access of the corresponding group attributes of the two end points of the edge at the current moment, and the greater the possibility of it being the basis for a collusion attack. At the same time, restrictions are imposed through node values, and the node value, that is, the attribute replacement coefficient, reflects the possibility of abnormal changes in the corresponding group attributes. The larger the minimum value of the attribute replacement coefficient at the two end points of the edge of the similar subgraph, the greater the possibility of abnormal changes in the corresponding group attributes of the two end points. When the possibility of abnormal changes in the corresponding group attributes is large, the greater the similarity of the edge value and the current attribute access, the more likely it is that a collusion attack is being prepared, and a greater graph access similarity needs to be assigned.

[0051] As an example, based on the nodes included in the similar subgraph and their corresponding users, and the graph access similarity between the similar subgraph and its corresponding fully connected graph, the possibility of each high-level user being attacked by collusion at the current moment is obtained, including the specific method of: For any high-level user's fully connected graph and any similar subgraph thereof, the user corresponding to the node contained in the similar subgraph is recorded as the participating user of the similar subgraph; then the access similarity coefficient between the similar subgraph and the fully connected graph is The calculation method is: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of nodes in the similar subgraph, represents the number of users participating in the similar subgraph, The total number of nodes included in the fully connected graph of all participating users of the similar subgraph.

[0052] Furthermore, the maximum value of the access similarity coefficients of all similar subgraphs of the fully connected graph is used as the possibility of the high-level user of the fully connected graph being attacked by collusion at the current moment.

[0053] It should be noted that the maximum access similarity coefficient in the similar subgraph can best reflect the occurrence of collusion attacks. The larger the maximum access similarity coefficient is, the more likely it is that a collusion attack will occur for high-level user permissions.

[0054] As an example, the possibility of collusion attack is determined, the abnormal access risk of the digital enterprise management platform is analyzed, and the electronic seals of each user are securely managed, including the following specific methods: An attack threshold is preset. In this embodiment, the attack threshold is described as 0.7. If the possibility of collusion attack of any senior user is greater than the attack threshold, it is necessary to replace the attribute permissions contained in the electronic seal in time; the senior user corresponding to the maximum value of the possibility of collusion attack among all senior users is replaced first, and after the replacement, the corresponding attributes in the electronic seals of users with the same attributes as the electronic seal of the senior user will be replaced; the possibility of collusion attack of the senior user at this time is calculated again according to the above method, and so on, to monitor the possible collusion attacks in real time and reduce the risk of abnormal access to the permissions of the electronic seals in the digital enterprise management platform.

[0055] At this point, by analyzing the connection relationship between the subgraph of the advanced user and other nodes based on the attribute access graph structure, and based on similar structures and the attribute replacement coefficients corresponding to the nodes and the current attribute access similarities between the nodes, the possibility of low-level users colluding to attack the permissions of advanced users is reflected, and then the user's electronic seal is securely managed by judging the possibility of collusion attacks, thereby reducing the risk of abnormal access to the digital enterprise management platform.

[0056] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for electronic seal security management of a digital enterprise, characterized in that: The method comprises the following steps: Obtain the attributes and access status of all users' electronic seals in the digital enterprise management platform; Obtain several groups of attributes of each user's electronic seal; analyze the historical changes of attributes in the same group of attributes and the overall access situation before the attribute changes, and compare the access situation of each user before the corresponding attribute changes, and obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal; Compare the changes in the access conditions of the two groups of attributes within a period of time before the current moment, and quantify the current attribute access similarity of any two groups of attributes; combine the attribute replacement coefficient of each group of attributes, and construct an attribute access graph structure for each group of attributes of all users' electronic seals, wherein each node in the attribute access graph structure corresponds to each group of attributes of each user's electronic seal; The similarity of the connection relationship between the subgraph of senior users in the attribute access graph structure and the nodes corresponding to each group of attributes of multiple users' electronic seals is analyzed, and the possibility of collusion attack for each senior user at the current moment is obtained in combination with the corresponding relationship between the nodes and the user's electronic seals, so as to perform security management of the electronic seals of each user.

2. According to the electronic seal security management method of a digital enterprise according to claim 1, it is characterized in that: The specific method for obtaining the several groups of attributes of each user's electronic seal is as follows: For any number of attributes contained in the electronic seal of a user, the start time and end time of each attribute are obtained since the electronic seal is obtained, and the duration of each attribute contained in the electronic seal of the user is obtained accordingly; The end time of any attribute is concatenated with the attributes with the same start time among the attributes other than the attribute, and several attributes are concatenated into a group of attributes, and so on to obtain several groups of attributes of the user's electronic seal.

3. The electronic seal security management method for a digital enterprise according to claim 2 is characterized in that: The method of analyzing the historical changes of attributes in the same group of attributes and the overall access situation before the attribute changes, and comparing the access situation of each user before the corresponding attribute changes, to obtain the attribute replacement coefficient of each group of attributes of each user's electronic seal includes the following specific methods: For User electronic seal In the group attributes property, get the The total access frequency of the corresponding permission from its start time to its end time, and record the The access frequency of each attribute corresponding to the permission from its start time to its end time on each day; Get the The ratio of the access frequency of the last day from the start time to the end time of the permission corresponding to the attribute to the total access frequency is obtained. The access frequency increment of each day from the start time to the end time of the corresponding permission of the attribute relative to the previous day is obtained. The average of the differences between the access frequency increment of the last day relative to the second last day and the access frequency increment of other days relative to the previous day from the start time to the end time of the corresponding permission of the attribute, and the product of the mean and the ratio is taken as the value of the first The abnormal change weight of each attribute; According to the duration of each attribute in the same group of attributes of the same user, and the access of the user to the corresponding authority of the attribute through the electronic seal, combined with the abnormal change weight, the attribute replacement coefficient of each group of attributes of each user's electronic seal is obtained.

4. The electronic seal security management method for a digital enterprise according to claim 3 is characterized in that: The method of obtaining the attribute replacement coefficient of each group of attributes of each user's electronic seal based on the duration of each attribute in the same group of attributes of the same user and the access of the user to the corresponding authority of the attribute through the electronic seal in combination with the abnormal change weight includes: Get the A user uses an electronic seal to In the group attributes The attribute corresponds to the access frequency of the permission from its start time to the last day of the end time. User electronic seal Attribute replacement coefficient of group attributes The calculation method is: in, Indicates User electronic seal The coefficient of variation of the duration of each attribute in the group attribute, Indicates User electronic seal the number of attributes in the group attribute, Indicates User electronic seal In the group attributes The abnormal change weight of each attribute, Indicates the The access frequency of each attribute corresponding to the permission from its start time to the last day of the end time. Indicates The user uses an electronic seal to The visit frequency of the last day from its start time to the end time.

5. The electronic seal security management method for a digital enterprise according to claim 1 is characterized in that: The specific method of comparing the changes in the access conditions of the two groups of attributes within a period of time before the current moment and quantifying the current attribute access similarity of any two groups of attributes includes: For the current moment, obtain the attributes of each group of attributes of each user's electronic seal at the current moment as the current attributes of each user. For any two groups of attributes of any two users' electronic seals, obtain the access frequency of the current attributes of any one of the two users from the start time to the end time when the user's electronic seal is changed to the current attribute, and arrange them in time sequence to form the access sequence of the user's current attribute. Obtain the access sequence of the current attribute of another user, and obtain the DTW distance between the two access sequences of the two current attributes of the two users through DTW matching; For the access sequences of the two current attributes of the two users, the last three elements of the two access sequences are respectively intercepted to form the access data segments of the two current attributes, and the cosine phase velocity and DTW distance between the access data segments of the two current attributes are obtained. The current attribute access similarity of the two sets of attributes of the electronic seals of the two users is calculated as follows: in, Indicates User electronic seal Group attributes and User electronic seal the current attribute access similarity of the group attributes, and Respectively represent User and The cosine phase velocity and DTW distance between the access data segments of the two current attributes of a user, Indicates User and The DTW distance between the access sequences of two current attributes of a user; For any two sets of attributes of the same user's electronic seal that correspond to each other at the current moment, the attributes are recorded as the current attributes of the two sets of attributes, and the start time of the current attributes of the user's electronic seal for the two sets of attributes is obtained, and the start time closest to the current moment to the current moment is used as the analysis period; The access frequency of the user's electronic seal to the current attributes of the two groups of attributes on each day during the analysis period is obtained, and the access frequency sequences of the current attributes of the two groups of attributes are respectively constructed in chronological order, and the cosine similarity between the two access frequency sequences is used as the current attribute access similarity of the two groups of attributes of the user's electronic seal.

6. The electronic seal security management method for a digital enterprise according to claim 1 is characterized in that: The specific method of constructing the attribute access graph structure for each group of attributes of all user electronic seals is as follows: The users whose electronic seals contain groups with a number less than the user classification parameter are regarded as low-level users, and the others are regarded as high-level users; For any senior user, each group of attributes of the senior user's electronic seal is regarded as a node, and each node corresponding to the senior user is fully connected to form a fully connected graph of the senior user, in which the node value is assigned as the attribute replacement coefficient of the corresponding group attribute, and the edge values ​​between nodes are all set to 1; For any low-level user, each group attribute of the low-level user's electronic seal is regarded as a node, and each node corresponding to the low-level user is fully connected to form a fully connected graph of the low-level user, in which the node value is assigned as the attribute replacement coefficient of the corresponding group attribute, and the edge value between nodes is set as the current attribute access similarity of different group attributes corresponding to the node; If the current attribute access similarity of different groups of attributes of different users is greater than the similarity threshold, the nodes corresponding to the two groups of attributes are connected, and the edge value is set to the corresponding current attribute access similarity; Similarly, the current attribute access similarity of each user's node is judged, and the corresponding nodes are connected and the corresponding edge values ​​are obtained; the graph structure composed of the fully connected graph of each user and the edges connecting the nodes in the fully connected graphs of different users is used as the attribute access graph structure.

7. The electronic seal security management method for a digital enterprise according to claim 6 is characterized in that: The method of analyzing the similarity of the connection relationship between the subgraph of the senior user in the attribute access graph structure and the nodes corresponding to the attributes of each group of the electronic seals of multiple users, and combining the corresponding relationship between the nodes and the electronic seals of the users, to obtain the possibility of each senior user being attacked by collusion at the current moment includes the following specific methods: For the fully connected graph of the advanced users, several similar subgraphs of the fully connected graph of each advanced user are obtained based on the connection relationship between the nodes of the users with lower authority; Analyze the difference between the node value and edge value between the similar subgraph and its corresponding fully connected graph, and obtain the graph access similarity between each similar subgraph and its corresponding fully connected graph; According to the nodes included in the similar subgraph and their corresponding users, as well as the graph access similarity between the similar subgraph and its corresponding fully connected graph, the possibility of each high-level user being attacked by collusion at the current moment is obtained.

8. The electronic seal security management method for a digital enterprise according to claim 7 is characterized in that: The fully connected graph of the advanced user is used to obtain several similar subgraphs of the fully connected graph of each advanced user based on the connection relationship between the nodes of the users with lower authority, including the specific method of: For any advanced user's fully connected graph, based on the current attributes of the corresponding group attributes of each node in the fully connected graph, several nodes with the same current attributes of the corresponding group attributes in the attribute access graph structure are obtained, and based on the connection relationship between the several nodes, several subgraphs with the same structure as the fully connected graph are obtained, which are recorded as several similar subgraphs of the fully connected graph.

9. The electronic seal security management method for a digital enterprise according to claim 8, characterized in that: The fully connected graph of the advanced user is used to obtain several similar subgraphs of the fully connected graph of each advanced user based on the connection relationship between the nodes of the users with lower authority, including the specific method of: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of edges in the fully connected graph, Indicates the similar subgraph The edge value of the edge, Indicates the first The edge value of the edge; Indicates the similar subgraph One endpoint of the edge corresponds to the attribute replacement coefficient of the group attribute. Indicates the similar subgraph The other end point of the edge corresponds to the attribute replacement coefficient of the group attribute; Represents a minimum value function.

10. The electronic seal security management method for a digital enterprise according to claim 7, characterized in that: The method of obtaining the possibility of collusion attack of each high-level user at the current moment based on the nodes included in the similar subgraph and their corresponding users, and the graph access similarity between the similar subgraph and its corresponding fully connected graph, includes the following specific methods: For any high-level user's fully connected graph and any similar subgraph thereof, the user corresponding to the node contained in the similar subgraph is recorded as the participating user of the similar subgraph; the access similarity coefficient between the similar subgraph and the fully connected graph is The calculation method is: in, Represents the graph access similarity between any similar subgraph and its corresponding fully connected graph, represents the number of nodes in the similar subgraph, represents the number of users participating in the similar subgraph, The total number of nodes included in the fully connected graph of all participating users of the similar subgraph.

Images